What it is about

Die Cisco ASA Appliance bietet Funktionen zur Sicherung von Anwendungssoftware, wie beispielsweise Firewall oder VPN. Cisco Secure Firewall Threat Defense ist eine Sicherheitslösung, die Funktionen wie Firewall, Intrusion Prevention und erweiterten Malware-Schutz in einer einzigen Appliance integriert. Cisco Internetwork Operating System (IOS) ist ein Betriebssystem, das für Cisco Geräte wie z. B. Router und Switches eingesetzt wird. Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Cisco ASA (Adaptive Security Appliance), Cisco Secure Firewall Threat Defense, Cisco IOS, Cisco IOS XE und Cisco IOS XR ausnutzen, um die Authentisierung zu umgehen und beliebigen Programmcode mit Administratorrechten auszuführen.

Under what conditions?

Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.

What can happen in the worst case

An attacker could use the vulnerability to

• die Authentisierung zu umgehen
• beliebigen Programmcode mit Administratorrechten auszuführen

Am I affected?

Affected according to the BSI:

• Cisco ASA (Adaptive Security Appliance)
• Cisco Secure Firewall Threat Defense
• Cisco IOS
• Cisco IOS XE
• Cisco IOS XR
• Cisco ASA (Adaptive Security Appliance) <9.16.4.85
• Cisco ASA (Adaptive Security Appliance) <9.18.4.67
• Cisco ASA (Adaptive Security Appliance) <9.20.4.10
• Cisco ASA (Adaptive Security Appliance) <9.22.2.14
• Cisco ASA (Adaptive Security Appliance) <9.23.1.19
• Cisco ASA (Adaptive Security Appliance) <9.12.4.72
• Cisco ASA (Adaptive Security Appliance) <9.14.4.28

and 5 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Cisco ASA (Adaptive Security Appliance) 9.16.4.85
• Cisco ASA (Adaptive Security Appliance) 9.18.4.67
• Cisco ASA (Adaptive Security Appliance) 9.20.4.10
• Cisco ASA (Adaptive Security Appliance) 9.22.2.14
• Cisco ASA (Adaptive Security Appliance) 9.23.1.19
• Cisco ASA (Adaptive Security Appliance) 9.12.4.72
• Cisco ASA (Adaptive Security Appliance) 9.14.4.28
• Cisco Secure Firewall Threat Defense 7.0.8.1
• Cisco Secure Firewall Threat Defense 7.2.10.2
• Cisco Secure Firewall Threat Defense 7.4.2.4
• Cisco Secure Firewall Threat Defense 7.6.2.1
• Cisco Secure Firewall Threat Defense 7.7.10.1

Is the vulnerability already being exploited?

• CVE-2025-20362: exploited in the wild according to CISA, in the catalogue since 25.09.2025.
• CVE-2025-20333: exploited in the wild according to CISA, in the catalogue since 25.09.2025.