Rapid7 Details Cisco ASA Zero-Day Exploit Chain (CVE-2025-20362 & CVE-2025-20333)

Rapid7 has published a detailed technical analysis showing how two zero-day flaws in Cisco Secure Firewall ASA and FTD—CVE-2025-20362 and CVE-2025-20333—form an exploit chain that enables unauthenticated remote code execution in affected devices, with WebVPN at the centre of the vulnerability. On 25 September 2025, Cisco published advisories for these flaws, which are known to be exploited in-the-wild in highly targeted attacks by an as-yet unknown threat actor.

CVE-2025-20362 bypasses authentication via path traversal, while CVE-2025-20333 is a buffer overflow that allows memory corruption, together permitting unauthenticated RCE on vulnerable appliances. Rapid7 notes that the chain affects systems with WebVPN (clientless VPN) enabled, and a PoC caused a vulnerable Cisco ASAv 9.16.4.71 to crash and reboot, evidencing exploitability though not weaponised for arbitrary code execution.

Cisco has patched these vulnerabilities in version 9.16.4.85 and later, and administrators are urged to disable clientless VPN if not strictly necessary and update promptly. According to the report, the root cause involves boundary handling in a Lua script used by WebVPN, with a path normalization flaw enabling authentication bypass akin to earlier CVEs.