Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, IOS Software, IOS XE Software, and IOS XR Software Web Services Remote Code Execution Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.0Security Advisory

TL;DR 📌

  • A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS…
  • Highest CVSS: 9.0 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20363.

What it is

CVE-2025-20363 is a remote code execution flaw in the web services component shared across several Cisco platforms: Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, IOS Software, IOS XE Software, and IOS XR Software. The root cause is improper validation of user-supplied input in HTTP requests handled by the web service.

The access path differs by platform. On ASA and FTD, an unauthenticated, remote attacker can reach the vulnerable code providing the device has one of several configurations that enable SSL listen sockets — these include Mobile User Security (MUS) and SSL VPN configurations, detailed in the advisory’s configuration tables. On IOS and IOS XE, the device is only exposed if the Remote Access SSL VPN feature is enabled, and exploitation requires an authenticated attacker with low privileges. On IOS XR, only the 32-bit build (identifiable via run uname -s returning QNX) running on ASR 9001 routers is affected, and only if the HTTP server is enabled (show running-config | include http server returns output). IOS XR on 64-bit (Linux-based) systems is not affected, and Cisco has confirmed NX-OS is not affected at all.

A successful exploit lets the attacker execute arbitrary code as root, which Cisco describes as potentially leading to complete compromise of the device. On ASA/FTD this is rated CVSS 9.0 (Critical); on IOS/IOS XE/IOS XR it’s rated 8.5, reflecting the authentication requirement. There are no workarounds — Cisco states this explicitly.

Cisco’s PSIRT says it is not aware of any public announcements or malicious use of this vulnerability at the time of publication.

What to do

  • Check configuration exposure first. For ASA/FTD, review running-config against the feature list in the advisory (MUS, SSL VPN and related webvpn settings) to confirm whether SSL listen sockets are enabled. For IOS/IOS XE, check whether Remote Access SSL VPN is configured. For IOS XR, run uname -s to confirm 32-bit (QNX) versus 64-bit (Linux), and check for http server in the running configuration — only 32-bit ASR 9001 with HTTP server enabled is affected.

  • Upgrade ASA on affected 5500-X models. If running ASA 9.12 or 9.14 on the 5512-X, 5515-X, 5525-X, 5545-X, 5555-X or 5585-X, move to the hidden release 9.12.4.72 or 9.14.4.28 respectively, available from the Cisco Software Download Center. These are the final releases for the 9.12 and 9.14 trains.

  • Use the Cisco Software Checker for all other ASA, FMC and FTD platforms to identify the first fixed release for your specific train — the advisory does not list a single fixed version applicable to every platform.

  • For IOS XR on affected 6.8 or 6.9 trains on ASR 9001, no fixed release is published directly; contact your support organisation and request a Software Maintenance Update (SMU).

  • No workaround exists, so mitigation is limited to disabling the exposed feature (SSL VPN, MUS, HTTP server) where operationally acceptable until the device can be upgraded, or upgrading directly.

  • Since exploitation requires attacker knowledge of the target and, per Cisco, may involve overcoming exploit mitigations, treat internet-facing ASA/FTD devices with the listed configurations as the highest priority for patching.

For leadership 🧭

Executive summary. Firewalls and routers running Cisco ASA, FTD, IOS, IOS XE or IOS XR with SSL VPN, MUS or HTTP server features enabled can be fully compromised by a crafted HTTP request, with ASA/FTD exploitable by anyone who can reach the device over the network without credentials. There is no workaround, so exposed devices need configuration review and patching this week, prioritising internet-facing ASA/FTD boxes.

Why it matters:

  • On ASA and Secure Firewall Threat Defense, an unauthenticated attacker who can reach the device’s SSL listen socket (via SSL VPN or Mobile User Security configuration) can execute arbitrary code as root — no login needed.
  • IOS and IOS XE devices are only exposed if Remote Access SSL VPN is enabled, but even a low-privilege authenticated user could pivot to full device compromise.
  • IOS XR is affected only on 32-bit (QNX) builds running on ASR 9001 routers with the HTTP server enabled — 64-bit Linux-based IOS XR and NX-OS are confirmed unaffected.
  • Cisco has published no workaround for any platform, meaning the only mitigations are disabling the exposed feature or applying a fixed release.

Now / Next / Later:

  • Now: Check every ASA, FTD, IOS, IOS XE and IOS XR device for the exposing configuration — SSL VPN or MUS settings on ASA/FTD and IOS/IOS XE, and HTTP server plus 32-bit QNX build on IOS XR ASR 9001 — to establish which devices are actually reachable.
  • Next: In the next change window, upgrade affected ASA 5500-X models (5512-X, 5515-X, 5525-X, 5545-X, 5555-X, 5585-X) on 9.12 or 9.14 to the hidden releases 9.12.4.72 or 9.14.4.28, use the Cisco Software Checker to find fixed releases for other ASA/FMC/FTD platforms, and request an SMU for IOS XR 6.8 or 6.9 on ASR 9001.
  • Later: Where upgrading isn’t immediately possible, disable SSL VPN, MUS or the HTTP server on exposed devices, and build a routine check of these web-service configurations into ongoing firewall and router hardening, since this is the second such advisory tied to continued attacks on Cisco firewall platforms.

Source