CVE-2025-20238: Cisco Adaptive Security Appliance (ASA) Software · Improper Authorization on Physical Debug and Test Interfaces
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 6.0 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-20238, organizations should: 1) Apply Cisco’s security patches and updates for all affected ASA and FTD software versions as soon as they become available. 2) Restrict administrative access to the physical and logical interfaces of ASA and FTD devices strictly to trusted personnel using strong authentication methods such as multi-factor authentication. 3) Disable or restrict access to physical debug and test interfaces where possible, or ensure they are physically secured to prevent unauthorized local access. 4) Implement rigorous input validation and command filtering policies on administrative interfaces to prevent injection of crafted commands. 5) Monitor firewall logs and system behavior for unusual command execution patterns or privilege escalations indicative of exploitation attempts. 6) Conduct regular audits of administrative accounts and credentials to detect and remove unauthorized or stale accounts. 7) Employ network segmentation to limit the exposure of critical firewall devices to only necessary management networks. 8) Train administrators on secure management practices and the risks associated with physical and local access to security devices.
Description
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input for specific commands. A successful exploit could allow the attacker to execute commands on the underlying operating system as root.