Authenticated root RCE in Cisco ASA and FTD VPN web server

Successful exploitation permits arbitrary code execution with root privileges and potentially complete compromise of an affected ASA or FTD appliance. Observed campaigns involving this vulnerability and CVE-2025-20362 have deployed malware, tampered with logging, executed malicious commands, and established persistence that can survive reboots and software updates. Attacks against unpatched devices have also caused repeated reloads and denial of service. These campaign outcomes may involve chained vulnerabilities and post-exploitation implants rather than CVE-2025-20333 alone.

If an immediate upgrade is not possible, disable all SSL/TLS-based VPN web services as directed by Cisco. Restrict WebVPN and management access with access controls, disable unnecessary services, and isolate management networks. Enable Threat Detection for VPN Services and retain logs externally. Disconnect unsupported appliances. These measures reduce exposure but do not replace patching or eradication of an existing compromise.

Upgrade affected ASA and FTD installations to the applicable Cisco fixed software release, using Cisco's Software Checker to determine exposure and the appropriate release. Specific fixed version numbers are not available here. Investigate potentially compromised devices using Cisco and CISA detection and response guidance; patching does not necessarily remove existing implants. Preserve forensic evidence and validate firmware and boot integrity. Rebuild or replace appliances where persistent compromise is confirmed, following vendor and incident-response guidance. For confirmed FIRESTARTER infections, follow CISA's device-specific removal guidance, which may require physically disconnecting all power sources. Reset associated passwords, certificates, and keys after securing the device.