VulnSocial
← Back to blog

CVE-2025-20333 – Critical Remote Code Execution in Cisco Secure Firewall Adaptive Security Appliance (ASA)/Cisco Firepower Threat Defense (FTD) VPN Web Server

Key Takeaways

  • Severity: Critical (CVSS 9.9)
  • Impact: Authenticated remote code execution → full device compromise, reboot, DoS.
  • Affected: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (e.g., version 7.6.0 and earlier).
  • Status: Actively exploited; listed in CISA KEV.
  • Action: Apply the patch immediately; enforce MFA, monitor VPN logs, hunt for the “FIRESTARTER” backdoor.

Overview

On 2025‑09‑25, Cisco disclosed a buffer‑overflow flaw in the VPN web server component of its Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) software. The vulnerability, identified as CVE-2025-20333, allows an attacker who has valid VPN credentials to send a crafted HTTP(S) request that overflows a memory buffer and executes arbitrary code with root privileges. Since the bug is reachable over the network and requires only low‑privilege authentication, it is classified as Critical.

Cisco later reported a new attack variant that chains this flaw with CVE-2025-20362 to install a persistent backdoor dubbed “FIRESTARTER.” The combined exploit has been observed in the wild, causing unexpected reboots, denial‑of‑service, and long‑term remote access.

Technical Details

  • Vulnerability type: Buffer overflow (CWE-120) in the VPN web server’s request parser.
  • Root cause: Improper validation of user‑supplied input in HTTP(S) requests.
  • Attack prerequisites:
    1. A valid VPN user account (the vulnerability is authenticated).
    2. Ability to send HTTP(S) traffic to the ASA/FTD web‑VPN interface.
  • Exploitation flow:
    1. Attacker authenticates to the VPN portal.
    2. Sends a specially crafted POST request containing an oversized payload.
    3. The payload overwrites the return address, hijacking execution flow.
    4. Arbitrary code runs as root, enabling full compromise, device reboot, or DoS.
    5. In the “FIRESTARTER” variant, the payload drops a backdoor that persists across reboots.

Example of a malicious request (illustrative only):

POST /+CSCOE+/vpn/webvpn HTTP/1.1
Host: vulnerable-firewall.example.com
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 8192

username=valid_user&password=valid_pass&payload=<crafted_overflow>

The FIRESTARTER backdoor establishes outbound C2 channels and can be used for lateral movement inside compromised networks. Threat intelligence feeds have reported active exploitation since late April 2026, with multiple days showing 5‑6 distinct exploitation events.

Severity & Impact

  • CVSS v3.1: 9.9 (Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
  • Impact metrics: Confidentiality = High, Integrity = High, Availability = High.
  • Scope: Changed (the exploit can affect the entire host).
  • CWE: CWE-120 – Buffer Copy without Checking Size of Input.
  • CISA KEV: The vulnerability is listed in the CISA KEV program (added 2025‑09‑25). Agencies are required to prioritize mitigation.

The combination of high severity, network‑reachable attack surface, and active exploitation makes CVE-2025-20333 one of the most urgent threats to Cisco firewall deployments.

Affected Products

  • Cisco Secure Firewall Adaptive Security Appliance (ASA) – all versions up to and including 7.6.0.
  • Cisco Firepower Threat Defense (FTD) – all versions up to and including 7.6.0.

For the complete list of affected versions and CPE identifiers, see the VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2025-20333.

Actionable Insights

  • Patch now. Apply Cisco’s security update as soon as it is available (see References).
  • Enforce multi‑factor authentication for all VPN users to raise the attack bar.
  • Disable or restrict the web‑VPN interface if patching cannot be performed immediately.
  • Rotate all VPN credentials and revoke any that may have been exposed.
  • Monitor for anomalies:
    • Unexpected device reboots or crash logs.
    • Unusual outbound connections from the firewall (possible FIRESTARTER C2 traffic).
    • Spike in VPN authentication failures or successful logins from new IP ranges.
  • Deploy IDS/IPS signatures that detect the known FIRESTARTER payload patterns (Cisco Talos and other vendors have released signatures).
  • Conduct a forensic hunt for the backdoor: look for unknown processes, scheduled tasks, or binaries named “firestarter” in the firewall’s file system.
  • Leverage CISA KEV guidance to document remediation steps and report compliance.

Remediation & Mitigation

  1. Identify vulnerable devices. Run show version on ASA/FTD appliances to confirm the software version.
  2. Apply the Cisco patch. Download the update from the Cisco Security Advisory (Reference 1).
  3. If patching is delayed, temporarily disable the VPN web server (no webvpn) or limit access to trusted management IPs via ACLs.
  4. Enable MFA for all VPN accounts (e.g., Duo, RSA SecureID).
  5. Rotate all VPN passwords and enforce strong password policies.
  6. Deploy network‑based detection (Snort, Suricata, Cisco Secure IPS) with signatures for the FIRESTARTER exploit chain.
  7. Audit logs for signs of exploitation: repeated reboots, system restart messages, or unknown process execution.
  8. Follow CISA KEV remediation checklist (Reference 3) and document the actions taken for compliance reporting.

Bottom Line

CVE-2025-20333 is a Critical remote‑code‑execution flaw in Cisco ASA/FTD VPN web servers that is actively exploited and listed in CISA KEV. Immediate patching, MFA enforcement, and vigilant monitoring for the FIRESTARTER backdoor are essential to prevent full firewall compromise and potential network‑wide breach.

For real‑time threat indicators, exploit timelines, and a full signal breakdown, visit the VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2025-20333.

References

#CVE #CVE202520333 #Critical #RCE #CISAKEV #Cisco #ASA #FTD