CVE-2025-20363: Cisco Secure Firewall Threat Defense remote code execution (CVSS 9.0)

Description

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Cisco Secure Firewall Threat Defense≥ 7.0.0 < 7.0.8 · ≥ 7.1.0 < 7.2.10 · ≥ 7.3.0 < 7.4.2.3 · ≥ 7.7.0 < 7.7.10

Cisco Adaptive Security Appliance Software≥ 9.12 < 9.12.4.72 · ≥ 9.14 < 9.14.4.28 · ≥ 9.16 < 9.16.4.84 · ≥ 9.17.1 < 9.18.4.57

Cisco iOS≥ 12.2\(15\)b ≤ 15.9\(3\)m11

Cisco iOS XE≥ 3.2.0sg ≤ 17.17.1

Cisco iOS XR6.5.1 · 6.5.2 · 6.5.3 · 6.6.25

Remediation

Fixed in

Cisco Secure Firewall Threat Defense≥ 7.0.8

Cisco Adaptive Security Appliance Software≥ 9.12.4.72

Patch & vendor advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3OVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-20363 being actively exploited?

CVE-2025-20363 is not in the CISA KEV catalog. Its EPSS exploit probability is 6.92%.

How severe is CVE-2025-20363?

CVE-2025-20363 has a CVSS 3.1 base score of 9.0, rated critical. EPSS estimates a 6.92% probability of exploitation.

Which products are affected by CVE-2025-20363?

Affected products include Cisco Secure Firewall Threat Defense, Cisco Adaptive Security Appliance Software, Cisco iOS, Cisco iOS XE, Cisco iOS XR.

How do I fix CVE-2025-20363?

Upgrade affected software to a fixed version, for example Cisco Secure Firewall Threat Defense 7.0.8, Cisco Adaptive Security Appliance Software 9.12.4.72 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-20363 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo