Two chained flaws in Cisco firewall VPN services were exploited before patches existed, prompting an emergency directive. What owners of Cisco ASA should check.
Publicly disclosed: 25 September 2025
On 25 September 2025 Cisco disclosed two vulnerabilities in the VPN web services of Cisco Secure Firewall ASA and FTD software that were already exploited in targeted attacks. The same day the U.S. agency CISA issued an emergency directive requiring federal agencies to find and fix affected devices.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2025-20333 | Critical, CVSS 9.9 (remote code execution, needs VPN credentials) | ASA and FTD with VPN web services enabled | Fixed releases listed in Cisco's advisory |
CVE-2025-20362 | Medium, CVSS 6.5 (access without authentication) | ASA and FTD with VPN web services enabled | Fixed releases listed in Cisco's advisory |
On its own, CVE-2025-20333 required valid VPN credentials. Combined with CVE-2025-20362, which allowed reaching protected URLs without logging in, attackers could take full control of the firewall. Older ASA hardware models that no longer receive updates remain at risk.
An unsupported firewall is a door with a lock nobody can fix anymore.
Sources: Cisco Security Advisories, CISA ED 25-03, NVD CVE-2025-20333.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
