Introduction
Remote attackers can gain root access to Cisco network infrastructure by exploiting a critical flaw in web services. CVE-2025-20363 affects a wide range of Cisco products, and a single HTTP request can fully compromise the enterprise and service provider networks that run them.
Cisco dominates the global networking market. Its ASA, FTD, and IOS platforms carry traffic for a vast number of enterprise, government, and service provider networks, and its products are deployed in millions of environments worldwide. A vulnerability in these systems reaches well beyond any one organization.
Technical information
CVE-2025-20363 is a heap-based buffer overflow (CWE-122) in the web services components of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software. The software does not properly validate user-supplied input in HTTP requests. When the affected web service receives a crafted HTTP request, the software allocates a heap buffer that is too small and then writes attacker-controlled data past the end of it. This can corrupt heap memory and let the attacker execute arbitrary code as root.
On Cisco ASA and FTD platforms, an attacker can perform the attack remotely and without authentication. On Cisco IOS, IOS XE, and IOS XR, the attacker must first authenticate with low privileges before sending the malicious HTTP request. To exploit the flaw, the attacker also has to gather additional information about the target system and bypass exploit mitigations such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). No public code snippets or proof of concept are available for this vulnerability.
Affected systems and versions
Public sources do not list specific affected versions for any of these products:
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Threat Defense (FTD) Software
- Cisco IOS Software
- Cisco IOS XE Software
- Cisco IOS XR Software
The vulnerability affects systems where the web services interface is enabled and accessible. On ASA and FTD, exploitation does not require authentication. On IOS, IOS XE, and IOS XR, exploitation requires authenticated access with low privileges.
Vendor security history
Cisco has had several critical vulnerabilities in its network infrastructure products in recent years. Related issues include:
- CVE-2025-20263: Buffer overflow in ASA and FTD web services
- CVE-2025-20352: SNMP vulnerability in IOS and IOS XE, known to be exploited in the wild
Cisco typically issues advisories and patches promptly. Even so, memory safety flaws keep turning up in its web services and management interfaces, which shows how hard secure software engineering remains for complex network devices.
