Cisco Warns of Active Exploitation of ASA and FTD 0

Cisco warns that hackers are actively exploiting a 0-day flaw in its firewall software, putting unpatched systems at risk of full compromise.

Cisco has issued a warning to customers after confirming that threat actors are actively exploiting a critical remote code execution (RCE) vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.

The flaw allows authenticated attackers to execute arbitrary code with root privileges, potentially resulting in full system compromise.

The vulnerability (CVE-2025-20333), first disclosed in September 2025 , arises from insufficient validation of user-supplied input in the VPN web server’s handling of HTTP(S) requests.

Attackers with valid VPN credentials can craft malicious requests that exploit a buffer overflow in the webvpn component, triggering remote code execution or device reboots.

In practice, this means adversaries could exfiltrate sensitive data, deploy malware, or pivot laterally into enterprise networks protected by these firewalls.

Cisco’s advisory highlights that systems running AnyConnect IKEv2 with client services, Mobile User Security (MUS), or SSL VPN configurations are especially at risk.

Affected versions span multiple software lines, including ASA 9.8.x through 9.20.1 and FTD 6.2.2 through 7.4.1.1.

Only systems with SSL listening sockets enabled for VPN access are vulnerable. Cisco’s Secure Firewall Management Center (FMC) software is not affected.

Cisco’s team confirmed that exploit attempts are already active in the wild. A new attack variant observed in early November 2025 causes targeted devices to reload unexpectedly, effectively creating a denial-of-service (DoS) condition.

The company has urged customers to immediately upgrade to fixed releases, such as ASA 9.18.4.19 and FTD 7.4.2, emphasizing that no workarounds exist.

Cisco recommends that administrators perform a configuration audit using the command show running-config to confirm exposure and to verify that no unauthorized changes have been made to VPN configurations.

The exploitation of CVE-2025-20333 is part of a broader trend of threat actors targeting network edge devices.

Firewalls, VPN gateways, and routers have become lucrative entry points for attackers seeking persistent access.

As these appliances often sit at the perimeter of sensitive networks, successful exploitation can give adversaries the ability to intercept traffic, harvest credentials, and deploy backdoors undetected.

While patching remains the top priority, organizations can take several complementary mitigation steps to strengthen resilience against ongoing exploitation campaigns:

These steps help reduce the attack surface and improve early detection capabilities, even if a system is temporarily exposed before patching.

The discovery and rapid exploitation of this vulnerability highlight the evolving speed and precision of modern cyber threats.

Zero-day exploits against trusted security infrastructure illustrate that even defensive technologies can become attack vectors when not continuously maintained.

A strong patch management program , combined with layered defenses and continuous monitoring, is critical to mitigating similar threats.

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.

Researchers found nine NuGet packages hiding time-delayed code that can crash apps or corrupt industrial systems.

The ClickFix malware now uses videos, timers, and OS-specific tricks to deceive users into infecting their own devices.

Cybercriminals are exploiting hotel booking platforms in a global phishing scheme that tricks guests into paying for reservations twice.

The CBO breach exposes how the government shutdown is weakening federal cybersecurity defenses when they’re needed most.