Introduction
In September 2025, Cisco released an urgent security advisory covering two critical vulnerabilities in its firewall/VPN products: CVE-2025-20333 and CVE-2025-20362. These flaws are already being exploited in the wild, meaning organizations should treat them as high priority.
This blog will explain what they are, how they work, who is affected, and what mitigations you need to take.
What are the vulnerabilities?
CVE-2025-20333
- This is a buffer overflow (CWE-120) vulnerability in the VPN web server of Cisco Secure Firewall ASA and FTD software. Cisco+3Rapid7+3NVD+3
- Specifically: “A vulnerability in the VPN web server … could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests … A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.” NVD+1
- It carries a CVSS 3.1 base score of 9.9 (Critical) according to Cisco’s CNA rating. NVD+1
- Note: It requires valid VPN credentials per Cisco’s description — though in practice it may be chained with other flaws. Zscaler+1
CVE-2025-20362
- This is a missing authorization (CWE-862) vulnerability in the same family of ASA/FTD VPN web-server software. NVD+1
- Description: “A vulnerability … could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. … due to improper validation of user-supplied input in HTTP(S) requests.” NVD+2Tenable®+2
- Base score: NVD lists 8.6 (High) for one vector; Cisco’s CNA lists 6.5 (Medium) for another vector. NVD+1
- Crucially, this flaw can be used to bypass authentication, making it easier to chain with the RCE in CVE-2025-20333. Rapid7+1
Why this matters (Threat context)
- These vulnerabilities affect core network-perimeter devices (firewalls/VPN appliances) which, if compromised, open the door to wide network infiltration.
- The fact that one allows remote code execution (CVE-2025-20333) is especially alarming.
- Active exploitation: According to several sources, attackers are already using these flaws (especially in combination) to compromise devices. Rapid7+2Zscaler+2
- Regulatory urgency: The Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog and issued an Emergency Directive (ED 25-03) requiring U.S. federal agencies to remediate promptly. CISA+1
- Large exposure: It’s estimated that tens of thousands of Cisco ASA/FTD devices remain unpatched and internet-exposed. TechRadar+1
Who / What is affected?
- Products: Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. Cisco
- Versions:
- For CVE-2025-20333: multiple branches of ASA software (9.8.x, 9.12.x, 9.14.x, 9.16.x, 9.17.x, 9.18.x, 9.19.x, 9.20.x, 9.22.x) and FTD versions (6.2.x, 6.4.x, 6.6.x, 7.0.x, 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x) are listed as vulnerable. Rapid7
- For CVE-2025-20362: similar versions plus ASA 9.23.x and FTD 7.7.x listed. Rapid7+1
- Configuration: Exposure of SSL VPN/WebVPN services, especially with remote access enabled, appears to be a key risk factor. Zscaler+1
- End-of-Support risk: Many affected ASA models (e.g., 5500-X series) may be nearing or past end-of-support, and lack modern protections (Secure Boot/Trust Anchor) which exacerbates impact. Zscaler+1
How the exploitation chain works
- Attackers first exploit CVE-2025-20362 (authentication bypass) to reach restricted WebVPN endpoints without credentials. Rapid7+1
- Then they exploit CVE-2025-20333 (buffer overflow) to achieve remote code execution (root level) on the device. Rapid7+1
- Post-exploit activities reported include: installing persistence modules (boot-kit style), disabling logging, manipulating bootloader/ROMMON, unexpected device reboots/DoS. Zscaler+1
- Because these are perimeter devices, once compromised the attacker may pivot into internal networks, exfiltrate data, or impair network security controls.
Recommended Mitigations & Actions
- Inventory & identify affected devices: Find all Cisco ASA/FTD devices in your environment with VPN WebVPN/SSL VPN enabled. Check versions and configuration. Zscaler
- Apply vendor patches immediately: Cisco has published fixed software releases. Upgrading is the only reliable mitigation. Cisco explicitly states no workarounds are recommended. Rapid7+1
- Restrict exposure: If possible, temporarily disable or restrict access to the WebVPN/SSL VPN interfaces, especially from untrusted networks. Limit administrative access and monitor logs for suspicious activity. Zscaler+1
- Post-patch verification and monitoring: After patching, check for signs of compromise (unexpected reboots, disabled logging, modified firmware, new credentials). Ensure logging is active and alerting for anomalous behaviour. Zscaler
- If compromise suspected: Follow Cisco guidance — reset device to factory defaults, replace credentials, regenerate certificates/keys, possibly rebuild the appliance. Zscaler+1
- Plan decommissioning for legacy hardware: For devices nearing end-of-support and lacking modern protections (Secure Boot/Trust Anchor), plan for replacement with more secure, supported models. Zscaler
Implications for IT & Security Teams
- Edge-security devices are high value targets: Firewalls and VPN endpoints sit at the frontier of the network. Compromise here severely weakens an organisation’s security posture.
- Credential + software chain = danger: While CVE-2025-20333 requires credentials, when combined with CVE-2025-20362 the barrier drops—attackers can bypass authentication then execute code.
- Exposure risk is large: Thousands of devices are estimated to still be internet-exposed and unpatched. Organisations and system owners need urgency. TechRadar
- Regulatory pressure and mandate: For U.S. federal agencies, compliance with CISA’s directive means this is not optional. Other sectors should treat similarly.
- Persistence and stealth: Attackers are reportedly implanting firmware-level persistence and disabling logs — forensic readiness is key.
- Legacy hardware is a liability: Devices without built-in protections (like Secure Boot) and nearing end-of-support become easy targets.
Conclusion
The dual vulnerabilities CVE-2025-20333 and CVE-2025-20362 in Cisco’s ASA/FTD firewall/VPN appliances represent a critical and active threat to enterprise network perimeters. Organisations using these devices must move quickly: identify vulnerable systems, apply updates without delay, monitor for signs of compromise, and evaluate replacing legacy equipment.
Security teams should treat this as a “first-door open” scenario: once the firewall is compromised, the attacker has a staging ground for deeper network intrusion. In the age of active exploitation, waiting is not an option.
(Visited 45 times, 1 visits today)