CVE-2025-20363

criticalpriority · track · 2EPSS 0.069 · 94 %ileDEEUNLRUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
6.92% (94th) EPSS
CVSS 9 · critical
Is it mine?
11,052 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

02

cvss

Technical severity, 0–10. One row per scoring source.

9.0
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19criticalAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · psirt@cisco.com USexploitability 2.2 · impact 6
v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)
v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL
v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Cisco PSIRT US
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-122USCWE-122USCWE-122US
05

affected products (11,052)

Products and version ranges known to be affected.

showing 20 of 11,052
06

advisories (3)

Vendor and ecosystem advisories describing this.

  • NCSC-2025-0298Kwetsbaarheden verholpen in Cisco Secure Firewall ASA en FTDNL2025-09-25csaf · ncsc_nlNL

    Cisco heeft kwetsbaarheden verholpen in Cisco Secure Firewall ASA en FTD Software.

  • WID-SEC-W-2025-2142Cisco ASA, FTD, IOS, IOS XE, IOS XR: Mehrere SchwachstellenDeutsch2025-09-25csaf · cert_bundDE

    Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Cisco ASA (Adaptive Security Appliance), Cisco Secure Firewall Threat Defense, Cisco IOS, Cisco IOS XE und Cisco IOS XR ausnutzen, um die Authentisierung zu umgehen und beliebigen Programmcode mit Administratorrechten auszuführen.

  • cisco-sa-http-code-exec-WmfP3h3OCisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, IOS Software, IOS XE Software, and IOS XR Software Web Services Remote Code Execution Vulnerability2025-09-25csaf · cisco_csafUS

    A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory. Cisco has released software updates that address this vulnerability and strongly recommends that customers upgrade to a fixed software release. There are no workarounds that address this vulnerability. For more information on the vulnerability that is described in this advisory, see Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms ["https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks"].

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundncsc_nlcisco_csafNVDCVE.orgMITRE
published 2025-09-25modified 2026-10-18
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan