# CVE-2025-20333: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

- Exploited (CISA KEV): yes, added 2025-09-25
- Published: 2025-09-25
- CVSS: 9.9 CRITICAL (v3.1)
- EPSS: 71.2% (99th percentile)
- CWE: CWE-120

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.

 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-09-28 | 3 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-12-03 | 69 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-09-28 · new · rule a1bef4ada0b146d2862cad439ee0ab84 · default Disabled
  > Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363. Previous action: N/A. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-09-28-emergency-waf-release/
- 2025-09-28 · new · rule 51de6ce6596a40eb8200452ad30f768e · default Disabled
  > Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363. Previous action: N/A. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-09-28-emergency-waf-release/
- 2025-10-07 · new · rule 12f808a5315441688f3b7c8a3a4d1bd6 · default Block
  > Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363. Previous action: N/A. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-10-07-emergency-waf-release/

### F5

- 2025-12-03 · new · rule 200011107
  > Added: signature 200011107 "Cisco ASA/FTD Buffer Overflow" (Buffer Overflow, risk High), systems: Cisco. References: CVE-2025-20333.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-20333 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-20333