Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-20363

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

CVSS 9.0 · CriticalBuzz score 43.0

Buzz score

Why this CVE is surfacing

Buzz score total 43.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 23.0 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
23.0
9 evidence mentions in the snapshot
Diversity score
20.0
8 sources across 4 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
9 source links · newest first
  • Cisco issues emergency patches for critical firewall vulnerabilitiesCSO Online

    Cisco has handed security teams one of the largest ever patching workloads affecting its firewall products, including fixes for two ‘perfect 10’ vulnerabilities in the company’s Secure Firewall Management Center (FMC) Software. Overall, the March 4 release, the first of its semiannual firewall updates for 2026, addresses 25 security advisories covering 48 individual CVEs. The […]

    newswww.csoonline.comMar 5, 2026, 5:19 PM
  • CVE-2025-20362 · CVE-2025-20333 · CVE-2025-20363Horizon3.ai

    Cisco ASA / FTD WebVPN Vulnerabilities

    exploithorizon3.aiOct 9, 2025, 9:19 PM
  • 29th September – Threat Intelligence ReportCheck Point Research

    For the latest discoveries in cyber research for the week of 29th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Stellantis, Automotive maker giant which owns Citroën, FIAT, Jeep, Chrysler, and Peugeot, has suffered a data breach that resulted in exposure of North American customer contact information after attackers accessed a third-party […]

    vendorresearch.checkpoint.comSep 29, 2025, 12:43 PM
  • Threat Insights: Active Exploitation of Cisco ASA Zero DaysUnit42

    CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363 affect multiple Cisco products, and are being exploited by a threat actor linked to the ArcaneDoor campaign.

    vendorunit42.paloaltonetworks.comSep 26, 2025, 8:30 PM
  • UK NCSC warns that attackers exploited Cisco firewall zero-days to deploy RayInitiator and LINE VIPER malwareSecurity Affairs

    UK NCSC warns that threat actors exploited Cisco firewall zero-days to deploy new malware strains RayInitiator and LINE VIPER. The U.K. NCSC reported that threat actors exploited recently disclosed Cisco firewall flaws (CVE-2025-20362, CVE-2025-20333) in zero-day attacks to deploy novel malware families, RayInitiator and LINE VIPER. These malware mark a major evolution from earlier campaigns, […]

    newssecurityaffairs.comSep 26, 2025, 11:49 AM
  • Cisco ASA zero-day vulnerabilities exploited in sophisticated attacksHelp Net Security

    A widespread campaign aimed at breaching organizations via zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) has been revealed by the US, UK, Canadian and Australian cybersecurity agencies. The suspected state-sponsored threat actor behind it is believed to be the one that perpetrated the ArcaneDoor attack campaign in 2023 and 2024, when they used custom malware to disable logging and preventing the creation of a crash dump (“Line Dancer”) and to install a backdoor that … More →

    newswww.helpnetsecurity.comSep 26, 2025, 11:19 AM
  • Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor AttacksSecurityWeek

    Leading to remote code execution and privilege escalation, the flaws were exploited on Cisco ASA 5500-X series devices that lack secure boot.

    newswww.securityweek.comSep 26, 2025, 7:05 AM
  • Patch now: Attacker finds another zero day in Cisco firewall softwareCSO Online

    A critical zero-day vulnerability in certain Cisco Systems firewalls has to be patched immediately, US and UK cyber authorities warned Thursday. They said exploits of the hole are part of ongoing attacks on these and other network perimeter devices. The UK’s National Cyber Security Centre (NCSC) called the alert from Cisco a “significant update” on […]

    newswww.csoonline.comSep 25, 2025, 9:15 PM
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3Osec.cloudapps.cisco.com

    No excerpt available.

    Vendor Advisorysec.cloudapps.cisco.comSep 25, 2025, 4:15 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence