Is CVE-2025-20333 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow) being exploited in the wild?

Yes. CISA added CVE-2025-20333 to its Known Exploited Vulnerabilities catalogue on 25 September 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution.

What this KEV listing means for Cisco ASA and FTD exposure

This CVE is not just a theoretical weakness. CISA’s decision to add it to the Known Exploited Vulnerabilities catalogue means defenders should treat affected Cisco Secure Firewall ASA and FTD VPN web server deployments as actively targeted until proven otherwise. The practical question is whether any internet-facing appliance, remote-access path, or exposed management function is still reachable in your environment.

A buffer overflow in a perimeter firewall is especially consequential because the vulnerable service sits in a high-trust position. If an attacker can reach it, the result can move quickly from unauthenticated exposure to remote code execution and then to broader network access, so scope and reachability matter as much as the CVE record itself.

For teams that already own the problem, the first task is to identify every ASA and FTD instance, including shadow deployments, failover pairs, lab systems, and appliances that may have been left exposed for VPN use or emergency access. If the device is still externally reachable, it belongs in the urgent response queue even before you confirm whether exploitation has occurred.

How exploitation happens and why it matters operationally

Buffer overflow exploitation on a VPN web server usually depends on sending crafted input to trigger memory corruption in a service that is reachable before authentication or with limited pre-authentication controls. That makes the exposure attractive because perimeter services are both widely reachable and operationally sensitive.

Once a device of this class is compromised, the risk is not limited to the vulnerable process. Security teams should assume the attacker may pursue configuration visibility, credential theft, session capture, or internal network pivoting, because firewalls and VPN gateways often handle secrets and privileged traffic flows that are valuable after initial access.

The main operational implication is that “patch later” is a weak strategy for internet-facing remote-access infrastructure. If patching must wait, the compensating controls have to reduce reachability, not just document risk. Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for the authoritative remediation path and timing, then verify that your containment choices actually remove the attack surface.

What to check before you declare the incident contained

Start with exposure verification, then move to compromise assessment. Confirm whether the device was internet-facing, whether remote administration was enabled, and whether any VPN or management endpoints were reachable from untrusted networks. That tells you where exploitation could have occurred and what logs should exist for the relevant window.

Then inspect for indicators that the appliance behaved differently than expected: unexpected reboots, altered configuration, new accounts or trust relationships, unexplained VPN sessions, missing logs, unusual outbound connections, or evidence that the device was used as a bridge into internal segments. If the firewall or VPN gateway handled secrets, treat those secrets as potentially exposed and rotate them where they provide ongoing access.

A useful baseline is the vendor’s own product guidance alongside the public exploitation record. Cisco’s advisory should drive version and configuration validation, while the KEV listing tells you the issue is already in active use by attackers, which raises the threshold for assuming the environment is clean.

Risk and Threat Considerations

This is a high-consequence perimeter flaw because it sits in a device that often mediates remote access, internal segmentation, and trust decisions. If attackers exploit it, they may gain a foothold that bypasses normal user authentication and gives them a privileged path into the network edge.

Failure mechanism: Crafted input overflows memory in the VPN web server, enabling remote code execution on a security appliance that is exposed to external traffic.

Impact: Attackers can take control of a trusted edge system, inspect or alter traffic-handling behavior, harvest credentials or sessions, and use the appliance as a pivot point into internal resources.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Limits exposed edge-device access and supports rapid removal of risky access paths.
Recommendation — Restrict appliance access paths and remove unnecessary administrative exposure.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Requires finding affected ASA and FTD assets and validating exposure quickly.
	SI-2 — Flaw Remediation	Directly governs timely remediation of a KEV-listed remotely exploitable flaw.
	AC-17 — Remote Access	Applies because the vulnerable service is tied to remote-access VPN exposure.
Recommendation — Scan for affected devices and verify where the vulnerable service is reachable. Apply the vendor fix or approved mitigation as soon as operationally possible. Tighten remote access to the appliance and minimize externally reachable functions.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Supports identifying exposed Cisco edge devices and their vulnerability status.
Recommendation — Identify every ASA and FTD instance and confirm whether it is exposed.

Practitioner Guidance

What to prioritise: Treat every exposed ASA or FTD instance as urgent until you have confirmed patch status, reachability, and log coverage. If the device is part of remote access, prioritise containment before routine maintenance because the attack path is already validated by CISA.

What to verify: Confirm whether the appliance had external reachability during the exposure window, whether administrative interfaces were segmented, and whether authentication or VPN logs still exist for that period. If logs are incomplete, compensate with network telemetry and configuration diffs rather than assuming absence of evidence means absence of compromise.

Decision rule: If the device was internet-facing and patching cannot happen immediately, reduce exposure first by limiting access paths, then assess whether any credentials, sessions, or keys touched by the appliance need rotation. If there are signs of intrusion, treat the appliance as a potential initial access and persistence point, not just a patched host.

Practitioner takeaway: For a KEV-listed buffer overflow in a perimeter firewall, the right mental model is “active exposure on a trust boundary,” not “routine vulnerability ticket.”