Critical · published September 25, 2025
CVSS calls it critical at 9.9. It is confirmed in active exploitation. It sits in the 99.4th percentile for exploit probability.
🚨 An authenticated attacker can send a crafted HTTP request to take complete control of your Cisco VPN! 🔥 This is like a hotel guest receiving a key card that lets them access not only their room but also the entire management office — they could change the locks and decide who stays or goes! If exploited, this vulnerability could allow an attacker to execute arbitrary code as root, potentially leading to a total compromise of the affected device. This means they could manipulate configurations, eavesdrop on traffic, or worse, launch attacks on your network!
This is like a hotel guest receiving a key card that lets them access not only their room but also the entire management office — they could change the locks and decide who stays or goes! This vulnerability arises from improper validation of user-supplied input in HTTP(S) requests, allowing remote attackers with valid VPN credentials to craft requests that execute malicious code.
If exploited, this vulnerability could allow an attacker to execute arbitrary code as root, potentially leading to a total compromise of the affected device. This means they could manipulate configurations, eavesdrop on traffic, or worse, launch attacks on your network! Immediately patch your Cisco Secure Firewall ASA Software or FTD Software to the latest version provided by Cisco. Ensure that only authorized users have VPN access and monitor your logs for unusual activities. 🔐 You've got this! Follow these steps and your VPN will be more secure in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| cisco/adaptive_security_appliance_software | ≥ 9.12, < 9.12.4.72 | 9.12.4.72 |
| cisco/adaptive_security_appliance_software | ≥ 9.14, < 9.14.4.28 | 9.14.4.28 |
| cisco/adaptive_security_appliance_software | ≥ 9.16, < 9.16.4.85 | 9.16.4.85 |
| cisco/adaptive_security_appliance_software | ≥ 9.17.0, < 9.17.1.45 | 9.17.1.45 |
| cisco/adaptive_security_appliance_software | ≥ 9.18, < 9.18.4.47 | 9.18.4.47 |
| cisco/adaptive_security_appliance_software | ≥ 9.19, < 9.19.1.37 | 9.19.1.37 |
| cisco/adaptive_security_appliance_software | ≥ 9.20, < 9.20.3.7 | 9.20.3.7 |
| cisco/adaptive_security_appliance_software | ≥ 9.22, < 9.22.1.3 | 9.22.1.3 |
| cisco/secure_firewall_threat_defense | ≥ 7.0.0, < 7.0.8.1 | 7.0.8.1 |
| cisco/secure_firewall_threat_defense | ≥ 7.1.0, < 7.2.9 | 7.2.9 |
| cisco/secure_firewall_threat_defense | ≥ 7.3.0, < 7.4.2.4 | 7.4.2.4 |
| cisco/secure_firewall_threat_defense | all versions | — |