CVE-2025-20333

ENISA EUVD: EUVD-2025-31140 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 5, 2026 8 articles Published: 2025-09-25
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23
29.79%
probability
This CVE has a 29.79% probability of being exploited in the next 30 days.
0% Top 96.7th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
9.9
CRITICAL
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

VulnerabilityLookup (CNA)
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Affected Products

Cisco
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
9.8.1 9.8.1.5 9.8.1.7 9.8.2 9.8.2.8 9.8.2.14
Cisco
Cisco Secure Firewall Threat Defense (FTD) Software
6.2.3 6.2.3.1 6.2.3.2 6.2.3.3 6.2.3.4 6.2.3.5

Attack Intelligence

Exploits & PoC

curtishoughton/Cisco-ASA-CVE-2025-20333-Scanner

Safe Python scanner for Cisco CVE-2025-20333 (Cisco ASA/FTD WebVPN Buffer Overflow)

0 2026-05-16
1 repo — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidenceⓘ
92%
EPSS 29.79%
CVSS v3.1 9.9
Mentions 8
Last Seen Apr 23, 2026

CNA Information

CNA Assigner
cisco

Analyst Note

CVE-2025-20333 is explicitly named in multiple authoritative sources as exploited in zero-day attacks against Cisco ASA/FTD devices. BleepingComputer and TheHackerNews directly confirm active exploitation, and CISA advisory signals urgent patching for exploited flaws. Published September 2025 with immediate exploitation reports indicates zero-day status.

Threat Actors 22

APT 29
apt_group Information theft and espionage 🇷🇺 RU
APT 28
apt_group Information theft and espionage 🇷🇺 RU
CHRYSENE
apt_group Information theft and espionage 🇮🇷 IR
Hacking Team
apt_group 🇮🇹 IT
Cleaver
apt_group Information theft and espionage 🇮🇷 IR
Tick
apt_group Information theft and espionage 🇨🇳 CN
HAZY TIGER
apt_group Information theft and espionage 🇮🇳 IN
Infy
apt_group Information theft and espionage 🇮🇷 IR
Group 27
apt_group Information theft and espionage 🇨🇳 CN
GCHQ
apt_group Information theft and espionage 🇬🇧 GB
ArcaneDoor
apt_group 🇨🇳 CN
APT 22
apt_group Information theft and espionage 🇨🇳 CN
APT 6
apt_group Information theft and espionage 🇨🇳 CN
Red October
apt_group 🇷🇺 RU
The White Company
apt_group Information theft and espionage 🇨🇳 CN
Pat Bear
apt_group 🇸🇾 SY
Unnamed Actor
apt_group 🇨🇳 CN
Shadow Network
apt_group Information theft and espionage 🇨🇳 CN
Mana Team
apt_group 🇨🇳 CN
APT 5
apt_group Information theft and espionage 🇨🇳 CN
Cyber Alliance
apt_group 🇺🇦 UA
Beijing Group
apt_group Information theft and espionage 🇨🇳 CN

Triage Info

Decided atMar 05, 2026
Published DateSep 25, 2025