{"id":7330,"date":"2025-10-01T10:03:35","date_gmt":"2025-10-01T10:03:35","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/10\/01\/48-cisco-firewalls-vulnerable-to-actively-exploited-0-day-vulnerability-in-the-wild\/"},"modified":"2025-10-01T10:03:35","modified_gmt":"2025-10-01T10:03:35","slug":"48-cisco-firewalls-vulnerable-to-actively-exploited-0-day-vulnerability-in-the-wild","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/10\/01\/48-cisco-firewalls-vulnerable-to-actively-exploited-0-day-vulnerability-in-the-wild\/","title":{"rendered":"48+ Cisco Firewalls Vulnerable to Actively Exploited 0-Day Vulnerability in the Wild"},"content":{"rendered":"

48+ Cisco Firewalls Vulnerable to Actively Exploited 0-Day Vulnerability in the Wild
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical zero-day vulnerability affecting thousands of Cisco firewalls is being actively exploited by threat actors in the wild.\u00a0<\/p>\n

The vulnerability, tracked as CVE-2025-20333<\/a>, poses an immediate risk to organizations worldwide with a CVSS score of 9.9, representing one of the most severe security flaws discovered in enterprise firewall infrastructure this year.<\/p>\n

According to data from The Shadowserver Foundation, over 48,800 unpatched IP addresses were identified on September 29, 2025, with the United States having received the most exposure.\u00a0<\/p>\n

The vulnerability affects Cisco Secure Firewall Adaptive Security Appliance (ASA)<\/a> Software and Cisco Secure Firewall Threat Defense (FTD) Software, specifically targeting the VPN web server component that millions of organizations rely on for remote access capabilities.<\/p>\n

\n
\"Cisco<\/figure>\n<\/div>\n

Cisco firewalls vulnerable<\/p>\n

Buffer Overflow Vulnerability (CVE-2025-20333)<\/strong><\/h2>\n

The vulnerability stems from improper validation of user-supplied input in HTTP(S) requests processed by the VPN web server.\u00a0<\/p>\n

Classified as a CWE-120 buffer overflow, the flaw allows authenticated remote attackers to execute arbitrary code with root privileges on affected devices.\u00a0<\/p>\n

This level of access essentially grants complete control over the firewall, enabling attackers to modify security policies, intercept network traffic, and establish persistent backdoors.<\/p>\n

The attack vector requires valid VPN user credentials, which attackers can obtain through various methods including credential stuffing<\/a>, phishing campaigns<\/a>, or exploiting weak authentication mechanisms.\u00a0<\/p>\n

Once authenticated, attackers can send specially crafted HTTP requests containing malicious payloads that overflow memory buffers, allowing shellcode execution in the context of the root user.<\/p>\n

Cisco\u2019s Product Security Incident Response Team (PSIRT) has confirmed active exploitation attempts and warns that successful attacks could result in complete device compromise.\u00a0<\/p>\n

The vulnerability affects devices running vulnerable releases of ASA or FTD software with specific configurations enabled, including AnyConnect IKEv2 Remote Access, Mobile User Security (MUS), and SSL VPN services.<\/p>\n

The affected configurations encompass critical enterprise features that organizations depend on for secure remote access. Vulnerable configurations include:<\/p>\n