Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Authenticated Command Injection Vulnerabilities

🚨SEVERITY: MEDIUM — CVSS 6.0Security Advisory

TL;DR 📌

  • Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit these vulnerabilities, the attacker must have valid administrative credentials. These vulnerabilities are due to insufficient input…
  • Highest CVSS: 6.0 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20238, CVE-2025-20237.

What it is

CVE-2025-20238 and CVE-2025-20237 are command injection vulnerabilities in Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. Both stem from insufficient input validation of user-supplied commands on the underlying operating system.

Exploitation requires local access and valid administrative credentials — this is not a remote, unauthenticated flaw. An attacker who has already authenticated to the device with high privilege can submit crafted input to specific commands and have it executed as root on the underlying OS, effectively escaping the ASA/FTD command shell into full root-level system control.

Cisco states the vulnerabilities affect ASA and FTD software regardless of device configuration. Secure Firewall Management Center (FMC) Software is confirmed not vulnerable. Cisco PSIRT says it is not aware of any public announcements or malicious use of these issues.

What to do

  • Treat this as a privilege escalation risk from admin to root, not an external attack surface issue — review who holds administrative credentials on affected ASA and FTD devices and tighten that list where possible.
  • There are no workarounds; the only remediation is upgrading to a fixed release. Use the Cisco Software Checker against your running ASA or FTD version to get the exact “First Fixed” and “Combined First Fixed” release for your platform, since this advisory is part of a bundled August 2025 publication covering multiple CVEs.
  • FMC Software does not need patching for this advisory, but if you manage FTD devices via FMC, follow the standard FMC upgrade guide when pushing the FTD fix.
  • Confirm device memory and current hardware/software compatibility before upgrading, per Cisco’s standard upgrade guidance, and contact Cisco TAC if compatibility is unclear.
  • Since exploitation requires authenticated admin access, ensure administrative session logging and credential hygiene (MFA, credential rotation, restricted admin access lists) are in place as compensating controls until the upgrade is completed.

For leadership 🧭

Executive summary. Two flaws in Cisco ASA and FTD software let someone with existing administrative login turn that access into root-level control of the firewall’s operating system. This is not remotely exploitable by outsiders, but any organisation with a large or loosely controlled admin group on these firewalls should schedule the fix in the next patch cycle rather than treat it as low priority because of the medium score.

Why it matters:

  • Any authenticated administrator on an affected ASA or FTD device can escalate from their existing admin shell to full root privileges on the underlying operating system, exceeding the access their role was meant to grant.
  • The flaw affects ASA and FTD regardless of how the device is configured, so there is no configuration change that removes exposure.
  • There are no workarounds - the only fix is upgrading firmware, so vulnerable devices stay exposed to insider or compromised-credential escalation until patched.
  • Firewall Management Center is confirmed unaffected, but any FTD devices it manages still need the underlying software upgraded.

Now / Next / Later:

  • Now: Review and tighten the list of accounts holding administrative credentials on affected ASA and FTD devices, since exploitation depends entirely on that access already existing.
  • Next: Run the Cisco Software Checker against each device’s current ASA or FTD release to get the exact fixed version, then schedule the upgrade in a maintenance window, using the FMC upgrade guide for FTD devices managed that way.
  • Later: Put ongoing controls on privileged firewall access - MFA for admin logins, regular credential rotation, and session logging - so that command-injection bugs like this can’t be turned into root compromise even before a patch lands.

Source