Cisco Security Updates – 28 September 2025

The addressed vulnerabilities could allow the attacker to perform denial of service attacks, conduct cross-site scripting attacks, gain elevated privileges, obtain sensitive information, or execute arbitrary commands and gain access to the affected product.

Sample of addressed vulnerabilities:

1. Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerability (CVE-2025-20333):

• CVSS: 9.9
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privileges

2. Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, IOS Software, IOS XE Software, and IOS XR Software Web Services Remote Code Execution Vulnerability (CVE-2025- 20363):

• CVSS: 9
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

Sample of the affected products:

• Cisco Secure Firewall Adaptive Security Appliance Software.
• Secure Firewall Threat Defense Software.
• Cisco Access Point Software Intermittent IPv6 Gateway.

It should be highlighted that Cisco is aware that the vulnerabilities “CVE-2025- 20333”, “CVE-2025-20362”, and “CVE-2025-20352” are being exploited in the wild.