Cyber Posture

CVE-2025-20363

Critical

Published: 25 September 2025

Published
25 September 2025
Modified
10 February 2026
KEV Added
Patch
CVSS Score 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0529 90.1th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20363 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Cisco Ios Xr. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the root cause of improper validation of user-supplied input in HTTP requests to prevent arbitrary code execution.

prevent

Remediates the specific flaw in web services through timely identification, testing, and application of vendor patches.

prevent

Implements memory safeguards like ASLR and DEP to mitigate exploitation attempts leading to unauthorized code execution as root.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct RCE via crafted HTTP requests to exposed web services on public-facing Cisco devices (unauth for ASA/FTD, low-priv auth for IOS variants).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker…

more

(Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

Deeper analysisAI

CVE-2025-20363 is a vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software. It stems from improper validation of user-supplied input in HTTP requests, classified under CWE-122, and carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). The issue was published on 2025-09-25.

An unauthenticated, remote attacker can exploit the vulnerability in Cisco ASA and FTD Software, while an authenticated, remote attacker with low user privileges can target Cisco IOS, IOS XE, and IOS XR Software. Exploitation involves sending crafted HTTP requests to a targeted web service on an affected device, potentially after obtaining additional system information or overcoming exploit mitigations. Successful exploitation allows the attacker to execute arbitrary code as root, leading to complete compromise of the affected device.

The Cisco Security Advisory provides further details on this vulnerability, including information in the Details section, and is available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O.

Details

CWE(s)

Affected Products

cisco
ios xr
6.5.1, 6.5.2, 6.5.3, 6.6.2, 6.6.25
cisco
adaptive security appliance software
9.12 — 9.12.4.72 · 9.14 — 9.14.4.28 · 9.16 — 9.16.4.84
cisco
ios
12.2\(15\)b — 15.9\(3\)m11
cisco
ios xe
3.2.0sg — 17.17.1
cisco
firepower threat defense
7.6.0 · 7.0.0 — 7.0.8 · 7.1.0 — 7.2.10 · 7.3.0 — 7.4.2.3

CVEs Like This One

CVE-2025-20333Same product: Cisco Adaptive Security Appliance Software
CVE-2025-20362Same product: Cisco Adaptive Security Appliance Software
CVE-2025-20352Same product: Cisco Ios
CVE-2026-20129Same vendor: Cisco
CVE-2025-20393Same vendor: Cisco
CVE-2026-20127Same vendor: Cisco
CVE-2025-20337Same vendor: Cisco
CVE-2025-20172Same product: Cisco Ios
CVE-2026-20131Same vendor: Cisco
CVE-2026-20103Same product: Cisco Adaptive Security Appliance Software

References