CVE-2025-20238

A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input for specific commands. A successful exploit could allow the attacker to execute commands on the underlying operating system as root.

• CWE-1244

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-cmdinj-VEhFeZQ3

Published

Aug 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-20232In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 …5.7
• CVE-2025-20233In the Splunk App for Lookup File Editing versions below 4.0…3.3
• CVE-2025-20234A vulnerability in Universal Disk Format (UDF) processing of…7.5
• CVE-2025-20235A vulnerability in the web-based management interface of Cis…6.1
• CVE-2025-20236A vulnerability in the custom URL parser of Cisco Webex App …8.8
• CVE-2025-20237A vulnerability in Cisco Secure Firewall Adaptive Security A…6
• CVE-2025-20239A vulnerability in the Internet Key Exchange Version 2 (IKEv…8.6
• CVE-2025-2024Trimble SketchUp SKP File Parsing Uninitialized Variable Rem…7.8
• CVE-2025-20240A vulnerability in the Web Authentication feature of Cisco I…6.1
• CVE-2025-20241A vulnerability in the Intermediate System-to-Intermediate S…7.4
• CVE-2025-20242A vulnerability in the Cloud Connect component of Cisco Unif…9.1
• CVE-2025-20243A vulnerability in the management and VPN web servers of Cis…8.6