Cisco Products Multiple Vulnerabilities

Last Update Date: 11 Nov 2025 Release Date: 25 Sep 2025 13879 Views

RISK: High Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities were identified in Cisco products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, cross-site scripting, security restriction bypass, remote code execution and sensitive information disclosure on the targeted system.

Note:

CVE-2025-20333, CVE-2025-20352, and CVE-2025-20362 are being exploited in the wild.

For CVE-2025-20333, an authenticated, remote attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected Cisco Secure Firewall Adaptive Security Appliance (ASA) Software or Cisco Secure Firewall Threat Defense (FTD) device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

For CVE-2025-20352, an authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software.

For CVE-2025-20362, an unauthenticated, remote attacker could access restricted URL endpoints on an affected device that is running Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software.

Proof of Concept exploit code are publicly available for CVE-2025-20149 and CVE-2025-20240.

For CVE-2025-20149, an authenticated, local attacker could exploit this vulnerability to trigger denial of service condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software.

For CVE-2025-20240, a remote attacker could exploit this vulnerability by persuading a user to click a malicious link, triggering cross-site scripting on an affected device that is running Cisco IOS XE Software.

For CVE-2025-20333 and CVE-2025-20362, a new attack variant can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions.

Hence, the risk level is rated as High Risk.

[Updated on 2025-09-26]

Updated Description, System / Technologies affected, Solutions, Vulnerability Identifier and Related Links.

[Updated on 2025-11-11]

Updated Description.

Impact

Denial of Service
Security Restriction Bypass
Remote Code Execution
Cross-Site Scripting
Information Disclosure

System / Technologies affected

Cisco Secure Firewall Adaptive Security Appliance (ASA)
Cisco Secure Firewall Threat Defense (FTD)
Cisco IOS
Cisco IOS XE

For affected versions, please refer to the link issued by the vendor:

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

Vulnerability Identifier

Source

Cisco