Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
CiscoSecure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
- Exploited in the wild
- In CISA KEV since 25 Sep 2025
- Vendor fix available
- Associated threat actor: Storm-1849
Passed 393 days ago
CISA KEV · added 25 Sep 2025
Higher than 99% of scored CVEs
Description NVD
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
CISA required action
The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 24 Apr · 11:30 UTC | SecurityWeek | US Agency Hit by Firestarter Backdoor on Cisco Firepower Gear |
| Fri 24 Apr · 18:06 UTC | The Hacker News | Cisco ASA Backdoor FIRESTARTER Persists After Patches, NCSC Warns |
| Sat 25 Apr · 01:26 UTC | Security Affairs | FIRESTARTER backdoor persists on patched Cisco ASA devices |
- FIRESTARTER backdoor persists on patched Cisco ASA devicesSecurity Affairs
- Cisco ASA Backdoor FIRESTARTER Persists After Patches, NCSC WarnsThe Hacker News
- US Agency Hit by Firestarter Backdoor on Cisco Firepower GearSecurityWeek · first in our coverage