CVE-2025-20333
BaseFortify
Publication date: 2025-09-25
Last updated on: 2025-10-28
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | adaptive_security_appliance_software | From 9.12 (inc) to 9.12.4.72 (exc) |
| cisco | adaptive_security_appliance_software | From 9.14 (inc) to 9.14.4.28 (exc) |
| cisco | adaptive_security_appliance_software | From 9.16 (inc) to 9.16.4.85 (exc) |
| cisco | adaptive_security_appliance_software | From 9.17.0 (inc) to 9.17.1.45 (exc) |
| cisco | adaptive_security_appliance_software | From 9.18 (inc) to 9.18.4.47 (exc) |
| cisco | adaptive_security_appliance_software | From 9.19 (inc) to 9.19.1.37 (exc) |
| cisco | adaptive_security_appliance_software | From 9.20 (inc) to 9.20.3.7 (exc) |
| cisco | adaptive_security_appliance_software | From 9.22 (inc) to 9.22.1.3 (exc) |
| cisco | firepower_threat_defense | From 7.0.0 (inc) to 7.0.8.1 (exc) |
| cisco | firepower_threat_defense | From 7.1.0 (inc) to 7.2.9 (exc) |
| cisco | firepower_threat_defense | From 7.3.0 (inc) to 7.4.2.4 (exc) |
| cisco | firepower_threat_defense | 7.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the VPN web server of Cisco Secure Firewall ASA and FTD software. It occurs because the software improperly validates user-supplied input in HTTP(S) requests. An attacker who has valid VPN user credentials can send specially crafted HTTP requests to the device, which could allow them to execute arbitrary code with root privileges, potentially leading to full compromise of the device.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to execute arbitrary code as root on the affected device, leading to complete compromise. This means the attacker could take full control of the device, potentially disrupting network security, stealing sensitive information, or using the device to launch further attacks.