Critical Cisco Flaw Lets Remote Attackers Execute Code on Firewalls and Routers

Cisco has disclosed a critical flaw affecting multiple platforms that handle HTTP-based management, tracked as CVE-2025-20363. According to Cisco Security Advisory cisco-sa-http-code-exec-WmfP3h3O, the vulnerability stems from improper validation of user-supplied input in HTTP requests and can allow full root code execution, leading to total device compromise on affected devices.

The affected products include Cisco Secure Firewall ASA and Secure Firewall Threat Defence (FTD) software, as well as IOS, IOS XE, and IOS XR with HTTP server enabled; on ASA/FTD an unauthenticated attacker can send malicious requests directly to SSL-enabled web services. The CVSS 3.1 base score is 9.0, with the impact described as complete loss of confidentiality, integrity and availability via a network-based attack.

There are no workarounds; users are urged to upgrade to the first fixed releases and use the Software Checker to determine exposure, with Cisco TAC assistance available for those unable to upgrade. Discovered by Keane O’Kelley of Cisco’s Advanced Security Initiatives Group during a TAC case, the advisory notes that no public exploits have been observed. 26 September 2025.