VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 15:28 UTC
← Dashboard

CVE-2025-20333

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is d…

Read full description
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
CVSS 9.9 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.9: +1.49
  • Fresh EPSS: 72.04%: +0.36

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 28 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

SDxCentral
Press · 28 Apr 2026, 07:00 · Cisco firewalls at risk from Firestarter bug: CISA - SDxCentral
Security Affairs
Press · 25 Apr 2026, 07:00 · CISA reports persistent FIRESTARTER backdoor on Cisco ASA device in federal network - Security Affairs
CyberSecurityNews
Press · 25 Apr 2026, 07:00 · Hackers Exploiting Cisco Firepower Devices’ Using n-day Vulnerabilities to Gain Unauthorized Access - CyberSecurityNews
The Hacker News
Press · 24 Apr 2026, 07:00 · FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches - The Hacker News
SecurityWeek
Press · 24 Apr 2026, 07:00 · US Federal Agency’s Cisco Firewall Infected With ‘Firestarter’ Backdoor - SecurityWeek
See all 28 source documents
Cisco Talos Blog
Press · 23 Apr 2026, 07:00 · UAT-4356's Targeting of Cisco Firepower Devices - Cisco Talos Blog
The Record from Recorded Future News
Press · 23 Apr 2026, 07:00 · CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March - The Record from Recorded Future News
Help Net Security
Press · 13 Nov 2025, 08:00 · "Patched" but still exposed: US federal agencies must remediate Cisco flaws (again) - Help Net Security
Industrial Cyber
Press · 13 Nov 2025, 08:00 · CISA urges immediate patching of Cisco ASA and Firepower devices due to active zero-day exploits - Industrial Cyber
BleepingComputer
Press · 13 Nov 2025, 08:00 · CISA warns feds to fully patch actively exploited Cisco flaws - BleepingComputer
Cybersecurity Dive
Press · 10 Nov 2025, 08:00 · Cisco detects new attack variant targeting vulnerable firewalls - Cybersecurity Dive
Rescana
Press · 09 Nov 2025, 08:00 · Cisco ASA and FTD Firewall Vulnerabilities: Active Exploitation of CVE-2025-20333 and CVE-2025-20362 Enables DoS Attacks and Full Device Compromise - Rescana
BleepingComputer
Press · 07 Nov 2025, 08:00 · Cisco: Actively exploited firewall flaws now abused for DoS attacks - BleepingComputer
The Hacker News
Press · 06 Nov 2025, 08:00 · Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362 - The Hacker News
Recorded Future
Press · 17 Oct 2025, 07:00 · September 2025 CVE Landscape - Recorded Future
Help Net Security
Press · 01 Oct 2025, 07:00 · Too many Cisco ASA firewalls still unsecure despite zero-day attack alerts - Help Net Security
Cybersecurity Dive
Press · 30 Sep 2025, 07:00 · Cisco firewall flaws endanger nearly 50,000 devices worldwide - Cybersecurity Dive
BleepingComputer
Press · 30 Sep 2025, 07:00 · Nearly 50,000 Cisco firewalls vulnerable to actively exploited flaws - BleepingComputer
SecurityWeek
Press · 26 Sep 2025, 07:00 · Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks - SecurityWeek
CyberSecurityNews
Press · 26 Sep 2025, 07:00 · Cisco ASA 0-Day RCE Vulnerability Actively Exploited in the Wild - CyberSecurityNews
Unit 42
Press · 26 Sep 2025, 07:00 · Threat Insights: Active Exploitation of Cisco ASA Zero Days - Unit 42
Rapid7
Press · 25 Sep 2025, 07:00 · Multiple critical vulnerabilities affecting Cisco products | CVE-2025-20333, CVE-2025-20362, CVE-2025-20363 - Rapid7
Bitsight
Press · 25 Sep 2025, 07:00 · CVE-2025-20333: Updates & Recommendations - Bitsight
The Hacker News
Press · 25 Sep 2025, 07:00 · Urgent: Cisco ASA Zero-Day Duo Under Attack; CISA Triggers Emergency Mitigation Directive - The Hacker News
CISA (.gov)
Press · 25 Sep 2025, 07:00 · ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices - CISA (.gov)
The Record from Recorded Future News
Press · 25 Sep 2025, 07:00 · Federal agencies given one day to patch exploited Cisco firewall bugs - The Record from Recorded Future News
GreyNoise
Press · 04 Sep 2025, 07:00 · 25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming - GreyNoise
Cisco Talos Blog
Press · 24 Apr 2024, 07:00 · ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices - Cisco Talos Blog

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.8 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.9; EPSS 72.0%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, low privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:29.589072+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
24 Apr 2024, 07:00
Added to the CISA KEV catalog
25 Sep 2025, 00:00
Published
25 Sep 2025, 16:12
Latest press mention
28 Apr 2026, 07:00
Score calculated
05 Nov 2026, 13:59
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar