Cisco Warns of Critical RCE Flaw (CVE-2025-20363) Affecting Firewall and Router Software

Cisco has disclosed a critical vulnerability tracked as CVE-2025-20363 that affects multiple Cisco product lines, including Secure Firewall ASA, Secure Firewall Threat Defense (FTD), IOS, IOS XE, and IOS XR Software, with NX-OS not affected.

The flaw, which has a CVSS base score of 9.0 for firewall products and 8.5 for IOS-based systems, arises from improper validation of user-supplied input in HTTP requests and could allow an unauthenticated or authenticated remote attacker to execute arbitrary code with root privileges. According to Cisco Security Advisory, the issue could enable code execution on an affected device, potentially leading to complete compromise if exploited.

Cisco notes that the vulnerability impacts Secure Firewall ASA and FTD Software when SSL VPN or MUS features are enabled, IOS and IOS XE Software if Remote Access SSL VPN is active, and 32-bit IOS XR Software on Cisco ASR 9001 routers with the HTTP server enabled. The company has released software updates addressing the flaw and strongly recommends customers upgrade to a fixed release.