This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes 20 vulnerabilities, 2 of them actively exploited
Cisco fixes 20 vulnerabilities in various products. The most severe ones can be found below. The remaining ones, including the list of vulnerable products, can be found at [1] by clicking through the individual advisories. The vulnerabilities CVE-2025-20333 and CVE-2025-20362 in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) have been added to CISA's Known Exploited Vulnerabilities catalog [2]. Products and their fixed versions: Cisco ASA Software - 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19 [3] Cisco FTD Software - 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1 [3] The availability of a fix for Cisco IOS, IOS XE and IOS XR Software can be verified using the Cisco Software Checker tool [4].
Allows an authenticated remote attacker with valid VPN credentials to execute arbitrary code with root privileges via specially crafted requests, due to insufficient input validation in HTTP(S) requests of the Cisco Secure Firewall ASA/FTD VPN web server [5].
The vulnerability is present in products:
- *:Cisco Secure Firewall Adaptive Security Appliance Software;
- *:Cisco Secure Firewall Threat Defense Software;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2025-20333 at cve.org, NVD
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org
The vulnerability was publicly disclosed 25. 9. 2025.
Allows an unauthenticated remote (Cisco ASA and FTD) or authenticated remote (Cisco IOS, IOS XE and IOS XR Software) attacker to execute arbitrary code with root privileges by sending specially crafted HTTP requests to the target web service, after obtaining additional information about the system, bypassing mitigations, or both [6].
The vulnerability is present in products:
- *:Cisco Secure Firewall Adaptive Security Appliance Software;
- *:Cisco Secure Firewall Threat Defense Software;
- *:Cisco IOS;
- *:Cisco IOS XE;
- *:Cisco IOS XR;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2025-20363 at cve.org, NVD
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 25. 9. 2025.
Allows an unauthenticated remote attacker to inject and execute commands with root privileges on the underlying operating system via a forged link, due to insufficient input validation in the HTTP API subsystem in Cisco IOS XE [7].
The vulnerability is present in product:
- *:Cisco IOS XE;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2025-20334 at cve.org, NVD
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 24. 9. 2025.
Allows an unauthenticated remote attacker to perform a DoS attack by sending malformed CAPWAP packets, due to their improper handling in the NBAR function in Cisco IOS XE [8].
The vulnerability is present in product:
- *:Cisco IOS XE;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
More information:
- CVE-2025-20315 at cve.org, NVD
- CWE-805: Buffer Access with Incorrect Length Value at cwe.mitre.org
The vulnerability was publicly disclosed 24. 9. 2025.
Allows an unauthenticated remote attacker to view sensitive information, or to bypass authentication and gain access to the affected device, in Cisco IOS and IOS XE by eavesdropping on unencrypted TACACS+ messages or by impersonating a TACACS+ server [9].
The vulnerability is present in products:
- *:Cisco IOS XE;
- *:Cisco IOS;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2025-20160 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 24. 9. 2025.
Allows an unauthenticated remote attacker to bypass authentication and access restricted VPN remote access URL endpoints on Cisco Secure Firewall ASA/FTD devices by sending crafted HTTP requests, due to insufficient validation of user input in HTTP(S) requests [10].
The vulnerability is present in products:
- *:Cisco Secure Firewall Adaptive Security Appliance Software;
- *:Secure Firewall Threat Defense Software;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:X/RL:X/RC:X
More information:
- CVE-2025-20362 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 25. 9. 2025.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/publicationListing.x
- [2] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- [3] https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
- [4] https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
- [5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
- [6] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
- [7] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cmd-inject-rPJM8BGL
- [8] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nbar-dos-LAvwTmeT
- [9] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJw
- [10] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
By CESNET, z.s.p.o. Michaela Jarošová on 29. 9. 2025.