A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device.
This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device.
For more information about this vulnerability, see the Details ["#details"] section of this advisory.
Metrics
Affected Vendors & Products
References
History
Mon, 29 Sep 2025 14:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Cisco firepower Threat Defense
|
|
CPEs | cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.6.0:*:*:*:*:*:*:* cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* |
|
Vendors & Products |
Cisco firepower Threat Defense
|
Fri, 26 Sep 2025 11:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Cisco
Cisco adaptive Security Appliance Software Cisco firepower Threat Defense Software Cisco ios Cisco ios Xe Software Cisco ios Xr Software |
|
Vendors & Products |
Cisco
Cisco adaptive Security Appliance Software Cisco firepower Threat Defense Software Cisco ios Cisco ios Xe Software Cisco ios Xr Software |
Thu, 25 Sep 2025 18:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Thu, 25 Sep 2025 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory. | |
Weaknesses | CWE-122 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: cisco
Published:
Updated: 2025-09-26T03:55:14.410Z
Reserved: 2024-10-10T19:15:13.258Z
Link: CVE-2025-20363

Updated: 2025-09-25T17:48:26.442Z

Status : Analyzed
Published: 2025-09-25T16:15:32.497
Modified: 2025-09-29T14:00:07.787
Link: CVE-2025-20363

No data.