CVE-2025-20238
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-14

Last updated on: 2025-08-15

Assigner: Cisco Systems, Inc.

Description
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input for specific commands. A successful exploit could allow the attacker to execute commands on the underlying operating system as root.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-14
Last Modified
2025-08-15
Generated
2026-05-07
AI Q&A
2025-08-14
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
cisco secure_firewall_asa *
cisco secure_firewall_ftd *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1244 The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in Cisco Secure Firewall ASA and FTD Software, where an authenticated local attacker with administrative credentials can execute arbitrary commands on the underlying operating system with root-level privileges. It is caused by insufficient input validation of user-supplied commands, allowing crafted inputs to be executed as root.


How can this vulnerability impact me? :

If exploited, this vulnerability could allow an attacker with administrative access to execute any command on the device's operating system as root, potentially leading to full control over the device, unauthorized access to sensitive data, disruption of network security functions, and further compromise of the network environment.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, ensure that only trusted administrators have access to the Cisco Secure Firewall ASA and FTD devices, as exploitation requires valid administrative credentials. Limit administrative access and monitor for any unusual command executions. Apply any available patches or updates from Cisco once released to address the insufficient input validation issue.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart