Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Critical Cisco Flaw Lets Remote Attackers Execute Code on Firewalls and Routers

On Fri, Oct 20, 2023, Cisco released a Security Advisory addressing a critical vulnerability in several Cisco platforms that manage HTTP-based communications. This vulnerability, identified as CVE-2025-20363 , results from inadequate validation of…

DBy Danielle FrostSep 26, 20252 min read

On Fri, Oct 20, 2023, Cisco released a Security Advisory addressing a critical vulnerability in several Cisco platforms that manage HTTP-based communications. This vulnerability, identified as CVE-2025-20363 , results from inadequate validation of user-supplied input in HTTP requests.

CVE Affected Products Impact CVSS 3.1 Score

CVE-2025-20363 Secure Firewall ASA & FTD with SSL VPN or MUS enabled; IOS/IOS XE with Remote Access SSL VPN; IOS XR (32-bit) on ASR-9001 with HTTP server enabled Full root code execution, total device compromise 9.0

The vulnerability allows attackers to execute arbitrary code as the root user, leading to a complete compromise of the affected device. The flaw affects:

Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) Software Cisco IOS, IOS XE, and IOS XR Software

This vulnerability, identified as CVE-2025-20363 , results from inadequate validation of user-supplied input in HTTP requests.
Danielle Frost · Thehackingpost

For ASA and FTD devices, attackers can exploit the vulnerability without authentication, sending crafted requests to SSL-enabled web services. On IOS, IOS XE, and IOS XR platforms, even low-privileged authenticated users can gain root access through this flaw.

Cisco has classified the impact as Critical , with a CVSS 3.1 base score of 9.0, indicating complete compromise of confidentiality, integrity, and availability through a network-based attack without user interaction.

No workarounds are available; only software updates fully mitigate the issue. Affected configurations include webvpn or crypto ssl policy settings on ASA/FTD and IOS/XE, or http server on IOS XR. The advisory provides bug IDs CSCwo18850, CSCwo35704, and CSCwo35779 for tracking purposes.

Customers should verify device configurations and upgrade to the fixed releases specified in the advisory. The Cisco Software Checker tool is available to determine exposure and obtain fixed software versions.

Advertisement

For IOS XR users on 32-bit ASR 9001 platforms, contacting Cisco TAC for SMUs is necessary. There have been no observed public exploits or attacks utilizing CVE-2025-20363.

Apply the fixed software releases for affected firewalls and routers immediately. Use the Cisco Software Checker to confirm platform exposure. Contact Cisco TAC for support if upgrades cannot be performed directly or if lacking a valid service contract.

Failure to address this vulnerability may lead to critical network infrastructure being compromised by remote adversaries. Timely deployment of patches is essential to maintain security across Cisco firewall and routing platforms.

Based on reporting by GBHackers.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026