CVE-2025-20363

CVE Enrichment

CVSS: 9.0 CRITICAL
EPSS: 6.92%
EPSS Percentile: 93.96%
CISA KEV: Not listed

Description

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: psirt@cisco.com
Published: 25-Sep-2025 23:15
Last Modified: 12-Aug-2026 02:33
EPSS Date: 2026-10-12
CWE: CWE-122

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

cisco / ios_xr
Version / affected range: 6.5.1
cpe:2.3:o:cisco:ios_xr:6.5.1:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.5.2
cpe:2.3:o:cisco:ios_xr:6.5.2:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.5.3
cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.6.2
cpe:2.3:o:cisco:ios_xr:6.6.2:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.6.3
cpe:2.3:o:cisco:ios_xr:6.6.3:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.6.25
cpe:2.3:o:cisco:ios_xr:6.6.25:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.7.1
cpe:2.3:o:cisco:ios_xr:6.7.1:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.7.2
cpe:2.3:o:cisco:ios_xr:6.7.2:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.7.3
cpe:2.3:o:cisco:ios_xr:6.7.3:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.8.1
cpe:2.3:o:cisco:ios_xr:6.8.1:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.8.2
cpe:2.3:o:cisco:ios_xr:6.8.2:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.9.1
cpe:2.3:o:cisco:ios_xr:6.9.1:*:*:*:*:*:x86:*
cisco / ios_xr
Version / affected range: 6.9.2
cpe:2.3:o:cisco:ios_xr:6.9.2:*:*:*:*:*:x86:*
cisco / adaptive_security_appliance_software
Version / affected range: * · from (inclusive) 9.12 · before (exclusive) 9.12.4.72
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cisco / adaptive_security_appliance_software
Version / affected range: * · from (inclusive) 9.14 · before (exclusive) 9.14.4.28
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cisco / adaptive_security_appliance_software
Version / affected range: * · from (inclusive) 9.16 · before (exclusive) 9.16.4.84
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cisco / adaptive_security_appliance_software
Version / affected range: * · from (inclusive) 9.17.1 · before (exclusive) 9.18.4.57
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cisco / adaptive_security_appliance_software
Version / affected range: * · from (inclusive) 9.19.1 · before (exclusive) 9.19.1.42
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cisco / adaptive_security_appliance_software
Version / affected range: * · from (inclusive) 9.20.1 · before (exclusive) 9.20.3.16
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cisco / adaptive_security_appliance_software
Version / affected range: * · from (inclusive) 9.22 · before (exclusive) 9.22.2
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cisco / adaptive_security_appliance_software
Version / affected range: * · from (inclusive) 9.23 · before (exclusive) 9.23.1.3
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cisco / ios
Version / affected range: * · from (inclusive) 12.2\(15\)b · through (inclusive) 15.9\(3\)m11
cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
cisco / ios_xe
Version / affected range: * · from (inclusive) 3.2.0sg · through (inclusive) 17.17.1
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
cisco / secure_firewall_threat_defense
Version / affected range: * · from (inclusive) 7.0.0 · before (exclusive) 7.0.8
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cisco / secure_firewall_threat_defense
Version / affected range: * · from (inclusive) 7.1.0 · before (exclusive) 7.2.10
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cisco / secure_firewall_threat_defense
Version / affected range: * · from (inclusive) 7.3.0 · before (exclusive) 7.4.2.3
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cisco / secure_firewall_threat_defense
Version / affected range: * · from (inclusive) 7.7.0 · before (exclusive) 7.7.10
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cisco / secure_firewall_threat_defense
Version / affected range: 7.6.0
cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.0:*:*:*:*:*:*:*

References

psirt@cisco.com

Last enrichment sync: 13-Oct-2026 06:00
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363. The following Snort Rules cover these vulnerabilities: 65340, 46897. Cisco Details ArcaneDoor Espionage Campaign Targeting Perimeter Devices

CVE (5)

Malware (2)

Threat Actors (2)

MITRE ATT&CK (14)

Vendors (2)

Products (9)

Tools (1)

Industries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.