PT-2025-33326 · Cisco · Cisco Secure Firewall Adaptive Security Appliance (Asa)+2

T.Ve · Published 2024-10-10 · Updated 2025-08-15 · CVE-2025-20238

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software (affected versions not specified)

Description: A flaw in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software may allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. The issue stems from insufficient input validation of user-supplied commands. An attacker could exploit this by authenticating to a device and submitting crafted input for specific commands, potentially gaining root-level access to the underlying operating system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unsafe Debug Access Level

Weakness Enumeration

CWE-1244

Related Identifiers

BDU:2025-11004

CVE-2025-20238

Affected Products

Cisco Asa

Cisco Secure Firewall Adaptive Security Appliance (Asa)

Cisco Secure Firewall Threat Defense (Ftd)

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-20238 · Security Note
• https://bdu.fstec.ru/vul/2025-11004 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-cmdinj-VEhFeZQ3 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-20238 · Security Note
• https://twitter.com/CVEnew/status/1956390332326670467 · Twitter Post