Skip to main content
عربي
logo

NCSC-VD-2510-001-02

Severity Level: Critical

Reference No.: NCSC-VD-2510-001-02

Cisco

Description

Cisco groups these vulnerabilities as mainly affecting Cisco ASA and FTD software. Impacts and severities are identified per CVE below.

CVE-2025-20333: A VPN web server vulnerability permits an authenticated remote attacker with valid VPN credentials to execute arbitrary code as root using crafted HTTP requests.

CVE-2025-20362: A VPN web server vulnerability permits an unauthenticated remote attacker to access restricted VPN URL endpoints using crafted HTTP requests.

CVE-2025-20363: A web services vulnerability permits an unauthenticated remote attacker to execute arbitrary code on affected devices.

Vulnerabilities

  • CVE-2025-20333

    A VPN web server vulnerability permits an authenticated remote attacker with valid VPN credentials to execute arbitrary code as root using crafted HTTP requests.

  • CVE-2025-20362

    A VPN web server vulnerability permits an unauthenticated remote attacker to access restricted VPN URL endpoints using crafted HTTP requests.

  • CVE-2025-20363

    A web services vulnerability permits an unauthenticated remote attacker to execute arbitrary code on affected devices.

References