CVE-2025-20333 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Summary

[Update of 07 November 2025] On 5 November 2025, Cisco updated its blog post initially published on 25 September 2025 (see Documentation section). The vendor states it is aware of a new attack affecting vulnerable ASA and FTD devices, which causes a remote denial of service. [Update of 06 October 2025] The CERT-FR is aware of public exploit code. [Initial publication] On 25 September 2025, Cisco published multiple security advisories, a blog post and a detection guide regarding vulnerabilities affecting the Web VPN server of Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). The vulnerability CVE-2025-20362 allows an attacker to bypass authentication to access protected resources. The vulnerability CVE-2025-20333 allows an authenticated attacker to perform remote arbitrary code execution. Exploit

Recommendation

[Update of 26 September 2025] Following several publications by CISA (including [2]), CERT-FR recommends performing the following actions: - run the command `show checkheaps` every minute for five minutes and save the results on a third-party system. An example of a result is presented in [1]; * the value in the `Totale number of runs` line must increment over time. If no change is observed, this indicates a potential compromise; - run the command `show tech-support detail` and save the results on a third-party system; - run the command `more /binary system:/text | grep 55534154 41554156 41575756 488bb3a0` and save the results on a third-party system; * if this command returns results, this indicates a potential compromise; - check the quantity of syslog events 302013, 302014, 609002 and 71005 [1] and [2] as a notable decrease may indicate a potential compromise; - at this stage, if a potential compromise is detected, consider disconnecting the equipment from the Internet and [immediately report the incident to CERT-FR](/contact/) which will advise you on the next steps; - if no compromise has been detected so far, perform the equipment update if it is available; * during the update process, monitor the messages displayed on the equipment console, in accordance with the steps presented in the `Bootloader and/or ROMMON Verification Failure` section of [1]; - after the update, search the equipment for the presence of a file named `firmware_update.log`; * if this file is present, retrieve its contents and save the results on a third-party system, this indicates a potential compromise, then consider disconnecting the equipment from the Internet and [report the incident to CERT-FR](/contact/

Summary

Multiple vulnerabilities have been discovered in Cisco products. They allow an attacker to cause remote arbitrary code execution and a security policy bypass. Cisco indicates that vulnerabilities CVE-2025-20333 and CVE-2025-20362 are actively exploited.

Recommendation

Refer to the vendor's security bulletin to obtain patches (see Documentation section).