Advisory 2025-1984 - Cisco ASA, FTD, IOS, IOS XE, IOS XR: Multiple Vulnerabilities

Operating System

• CISCO Appliance

Software

• Cisco ASA (Adaptive Security Appliance)
• Cisco ASA (Adaptive Security Appliance) < 9.12.4.72
• Cisco ASA (Adaptive Security Appliance) < 9.14.4.28
• Cisco ASA (Adaptive Security Appliance) < 9.16.4.85
• Cisco ASA (Adaptive Security Appliance) < 9.18.4.67
• Cisco ASA (Adaptive Security Appliance) < 9.20.4.10
• Cisco ASA (Adaptive Security Appliance) < 9.22.2.14
• Cisco ASA (Adaptive Security Appliance) < 9.23.1.19
• Cisco IOS
• Cisco IOS XE
• Cisco IOS XR
• Cisco Secure Firewall Threat Defense
• Cisco Secure Firewall Threat Defense < 7.0.8.1
• Cisco Secure Firewall Threat Defense < 7.2.10.2
• Cisco Secure Firewall Threat Defense < 7.4.2.4
• Cisco Secure Firewall Threat Defense < 7.6.2.1
• Cisco Secure Firewall Threat Defense < 7.7.10.1

Attack

A remote authenticated or anonymous attacker can exploit multiple vulnerabilities in Cisco ASA (Adaptive Security Appliance), Cisco Secure Firewall Threat Defense, Cisco IOS, Cisco IOS XE and Cisco IOS XR in order to bypass authentication and execute arbitrary code with administrative rights.

Description

The Cisco ASA provides application security functions, e.g. firewall and VPN. Cisco Secure Firewall Threat Defense is a security solution integrating firewall, intrusion prevention, and advanced malware protection capabilities into a single appliance. Cisco Internetwork Operating System (IOS) is a proprietary operating system by Cisco.

There is a vulnerability in Cisco ASA (Adaptive Security Appliance) and Cisco Secure Firewall Threat Defense. This vulnerability affects the VPN web server component due to improper validation of user-supplied input in HTTP(S) requests. A remote authenticated attacker with valid VPN credentials can exploit this vulnerability by sending crafted HTTP requests to the affected device to execute arbitrary code as root. This vulnerability affects Cisco Secure Firewall ASA Software if AnyConnect IKEv2 Remote Access with client services, Mobile User Security (MUS), or SSL VPN is enabled, and Cisco Secure Firewall FTD Software if AnyConnect IKEv2 Remote Access with client services or AnyConnect SSL VPN is enabled, as these features cause the SSL listen sockets to be active.

There is a vulnerability in Cisco ASA (Adaptive Security Appliance) and Cisco Secure Firewall Threat Defense. This flaw exists due to improper validation of user-supplied input in HTTP(S) requests in the VPN web server. A remote anonymous attacker can exploit this vulnerability by sending crafted HTTP requests to bypass authentication. This vulnerability affects Cisco Secure Firewall ASA Software if AnyConnect IKEv2 Remote Access with client services, Mobile User Security (MUS), or SSL VPN is enabled, and Cisco Secure Firewall FTD Software if AnyConnect IKEv2 Remote Access with client services or AnyConnect SSL VPN is enabled, as these features activate the SSL listen sockets. This vulnerability can be chained with CVE-2025-20333, which enables arbitrary code execution as root.

There is a vulnerability in Cisco ASA (Adaptive Security Appliance), Cisco Secure Firewall Threat Defense, Cisco IOS, Cisco IOS XE and Cisco IOS XR. This flaw exists due to improper validation of user-supplied input in HTTP requests. A remote anonymous attacker can exploit this vulnerability on ASA and FTD, while a remote authenticated attacker with low privileges can exploit it on IOS, IOS XE, and IOS XR Software, to execute arbitrary code as root, potentially leading to the complete compromise of the affected device. The affected configurations require SSL VPN or Mobile User Security to be enabled on ASA, AnyConnect SSL VPN to be enabled on FTD, and Remote Access SSL VPN to be enabled on IOS, IOS XE, and IOS XR Software.

The rating of the risk of this Advisory is based on the maximum values of all vulnerabilities. So the over all value is major than the value of the separate vulnerabilities.