Product:
Cisco Secure Firewall
Summary
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.9 | CVE-2025-20333 |
Exploitation
An attacker with valid VPN user credentials can exploit this vulnerability by sending specially crafted HTTP requests to the affected device. If successful, the attacker could execute arbitrary code as root, potentially leading to a complete compromise of the device.
Affected Products
- Cisco Secure Firewall Adaptive Security Appliance Software: Vulnerable due to improper input validation in the VPN web server.
- Cisco Secure Firewall Threat Defense Software: Also affected by the same vulnerability in the VPN web server.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Cisco for the affected products. Additionally, restricting access to the VPN web server and monitoring for unusual activity can help reduce the risk of exploitation.