Descripción
Cisco Secure Firewall Adaptive Security (ASA) Appliance y Secure Firewall Threat Defense (FTD) Software VPN Web Server contienen una vulnerabilidad de desbordamiento de búfer que permite la ejecución remota de código (RCE). Esta vulnerabilidad podría encadenarse con CVE-2025-20362.
Acción recomendada
Aplicar los pasos de mitigación publicados por CISA y las instrucciones del fabricante. En servicios en la nube, seguir las recomendaciones de seguridad del proveedor; si no hay mitigaciones disponibles, discontinuar el uso del producto.
Referencia de CISA para agencias federales de EE. UU.: BOD 22-01.
Referencias
- Instrucciones de mitigación de CISA cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potent…
- Documento de CISA cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-…
- Documento de CISA cisa.gov/eviction-strategies-tool/create-from-template
- Aviso de sec.cloudapps.cisco.com sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_a…
- Aviso de sec.cloudapps.cisco.com sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_con…
- Aviso de sec.cloudapps.cisco.com sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory…
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2025-20333
Ver el texto original en inglés (CISA)
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.
Required action: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB ; https://nvd.nist.gov/vuln/detail/CVE-2025-20333
Otras vulnerabilidades de Cisco en el catálogo
- CVE-2026-76519 Vulnerabilidad de recorrido de directorios relativo (path traversal) en Cisco Secure Email Gateway Alta 14-10-2026
- CVE-2026-76504 Vulnerabilidad de codificación hexadecimal en Cisco Catalyst SD-WAN Manager Alta 30-09-2026
- CVE-2026-76460 Vulnerabilidad de uso incorrecto de API privilegiadas en Cisco Identity Services Engine Alta 16-09-2026
- CVE-2026-76461 Vulnerabilidad de inyección SQL en Cisco Secure Email Gateway Alta 14-09-2026
- CVE-2026-20079 Vulnerabilidad de omisión de autenticación mediante una ruta o canal alternativo en Cisco Firewall Management Center Alta 09-09-2026