What is the risk?
There are three different vulnerabilities involved in active exploitation:
- The vulnerability identified as CVE-2025-20333 could allow an attacker with valid VPN credentials to execute arbitrary code with root privileges, potentially leading to complete compromise of the device.
- The vulnerability identified as CVE-2025-20362 could grant an attacker unauthenticated access to a restricted URL upon successful exploitation.
- The vulnerability identified as CVE-2025-20363 could be exploited by an attacker sending specially crafted HTTP requests to a targeted web service on an affected device, after obtaining additional system information, bypassing exploit mitigations, or both, and upon successful exploitation, allow arbitrary code execution with root privileges, which could also lead to complete compromise of the device.
Cisco is aware of attempts to exploit these vulnerabilities. There is (currently) no public Proof-of-Concept code (PoC) or exploit available. The National Cyber Security Centre (NCSC) expects that PoCs or exploits will become available very soon. This increases the risk of widespread exploitation.
What can you do?
Cisco has released updates to address the vulnerabilities. Cisco has also published Indicators of Compromise (IoCs), which can be used to investigate whether a system has been compromised, and temporary mitigation steps have been made available. See the attached links:
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
https://sec.cloudapps.cisco.com/security/center/resources/detection_guide_for_continued_attacks
If your company is using Cisco Secure Firewall ASA (Adaptive Security Appliance) and FTD (Firepower Threat Defense) Software, the Digital Trust Center (DTC) advises to install the security updates as soon as possible and check your system for the presence of IoCs. If you are unsure whether you are using this software, check with your IT service provider. Read more about edge devices.
Need help? Engage external expertise with 50% subsidy
Not sure what to do? Or do you lack the knowledge and experience to take appropriate measures? Then contact an IT service provider or supplier. A subsidy for small businesses is available until October 31, 2025. This can reimburse up to 50% of the costs for a significant number of measures to enhance your digital resilience.
