onyx --cves cve-2025-20333
CVE-2025-20333
- score
- <0.1
- cvss
- 9.9
- epss
- 71.2%
- published
- 2025-09-25
- kev added
- 2025-09-25
- first seen
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software contain a remote code execution caused by improper validation of user-supplied input in HTTP(S) requests, letting authenticated remote attackers execute arbitrary code as root, exploit requires valid VPN user credentials.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Added to CISA KEV
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 13
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-CISAED25-03
- https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025
- https://fortiguard.fortinet.com/outbreak-alert/cisco-asa-and-ftd-firewall-zero-day
- https://cert.europa.eu/publications/threat-intelligence/cb25-12/
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
- https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf
- https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026
- https://cyble.com/resources/research-reports/global-cybersecurity-report/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333
- https://eclypsium.com/blog/firestarter-cisco-firewall-backdoor-survives-patches/
- https://www.fortinet.com/library/soc-dgt/global-threat-landscape-report
- https://blog.talosintelligence.com/uat-4356-firestarter/