Search: CVE-2025-20333

CVE-2025-20333 is a critical buffer overflow vulnerability in the VPN web server component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. It allows an authenticated remote attacker with valid VPN credentials to send crafted HTTP(S) requests that can lead to arbitrary code execution as root. Successful exploitation could result in full compromise of the affected device. The vulnerability arises from improper validation of user-supplied input in HTTP(S) requests. The CVSS v3.1 base score is 9.9, indicating critical severity. Multiple specific 9.8.x and 9.8.3.x versions are affected. Exploits are known to be in the wild. No patch information is provided in the input data.