## https://sploitus.com/exploit?id=FFC6AC58-4404-57E3-B787-23C5935376A9
# CVE-2025-20333 - Complete Research & Exploitation Toolkit
## Overview
This directory contains comprehensive research, analysis, and proof-of-concept code for **CVE-2025-20333**, a critical stack buffer overflow vulnerability in Cisco ASA/FTD WebVPN servers.
**Status:** ⚠️ Actively exploited in the wild (ArcaneDoor campaign)
**CVSS Score:** 9.8 Critical
**Authenticated:** No (bypassed via CVE-2025-20362)
**Impact:** Remote Code Execution as root
---
## Contents
### 📚 Documentation
#### [`CVE-2025-20333-RESEARCH-NOTES.md`](CVE-2025-20333-RESEARCH-NOTES.md) (**20 KB**)
**Complete reverse engineering research**
- Vulnerability context & web intelligence
- Binary analysis (ASA 9.12.4.x lina process)
- Request-ingestion layer audit
- Lua API bindings analysis
- **🎯 Overflow discovery** (body_lexer.re2c, FUN_0302e690)
- Attack chain breakdown
- Root cause analysis with code patterns
- Tool & address reference table
**Key Finding:**
```
Fixed 16-byte buffer (local_58[16]) in body_lexer.re2c
URL-decoding loop has NO BOUNDS CHECK
Writing to local_58[iVar11] without checking iVar11
# Or bash version:
./cve-2025-20333-poc.sh
```
3. **Verify Exploitation**
- Check for shell access / reverse shell connection
- Examine system logs for crashes or anomalies
- Scan for modified files (NVRAM, persistent backdoor)
4. **Document Findings**
- Record target version, patch level
- Document exploitation success/failure
- Note any defensive measures encountered
- Report to client with remediation recommendations
### For Security Research
1. **Read Research Notes**
- Study `CVE-2025-20333-RESEARCH-NOTES.md`
- Understand binary architecture and overflow mechanism
2. **Study PoCs**
- Review Python PoC for ROP gadget construction
- Review bash PoC for minimal exploit
- Understand payload encoding
3. **Adapt & Extend**
- Add custom shellcode
- Implement different exploitation techniques
- Test on patched vs. vulnerable versions
---
## Important Warnings
⚠️ **LEGAL NOTICE**
This toolkit is provided **for authorized security testing only**.
- **DO NOT** use against systems without explicit written permission
- **DO NOT** use for malicious purposes (data theft, service disruption, ransomware)
- Unauthorized access violates the **Computer Fraud and Abuse Act (USA)** and similar laws worldwide
- Penalties include criminal prosecution, fines, and imprisonment
✅ **Authorized Use:**
- Penetration tests with written approval
- Proof-of-concept during vulnerability research
- Internal security testing
- CTF competitions
- Academic research
❌ **Prohibited Use:**
- Attacking systems without permission
- Ransomware deployment
- Data theft or extortion
- Service disruption
- Lateral movement in compromised networks
---
## Files Manifest
```
cve-2025-20333/
├── README.md (this file)
├── CVE-2025-20333-RESEARCH-NOTES.md (20 KB, comprehensive research)
├── EXPLOITATION-GUIDE.md (12 KB, practical guide)
├── cve-2025-20333-poc.py (15 KB, Python PoC)
└── cve-2025-20333-poc.sh (8.5 KB, bash PoC)
```
**Total Documentation:** ~65 KB
**Research Depth:** 50+ Ghidra functions audited
**Verified Findings:** Buffer overflow in body_lexer.re2c confirmed
---
## Quick Reference
### Vulnerability Quick Test
```bash
# Test if target is vulnerable to exploitation
curl -X POST https:///+CSCOU+/../+CSCOE+/files/file_list.json \
-d "name=%2f%2f%2f%2f%2f%2f%2f%2f%2f" \
--insecure \
-i
# If target responds (200, 500, crash), it may be vulnerable
# If target blocks/redirects, it may be patched
```
### Version Check
```bash
# Vulnerable versions:
# - Cisco ASA 9.16 through 9.23
# - Cisco FTD 7.0 through 7.7
# Use SSH/console to check ASA version:
show version
# Patched versions:
# - ASA 9.16.4.51, 9.18.4.31, 9.20.4.49, 9.22.4.9, 9.24.1+
# - FTD 7.0.x, 7.1.x, 7.2.x (patched)
```
### Mitigation Checklist
- [ ] Verify ASA/FTD version
- [ ] Check for available patches
- [ ] Upgrade to patched version if vulnerable
- [ ] Restrict WebVPN access by IP address
- [ ] Enable logging and monitoring
- [ ] Watch for CVE-2025-20362 path traversal attempts
- [ ] Monitor for DoS patterns (lina crashes)
- [ ] Enable firewall protection on WebVPN port
---
## References
- **Cisco Security Advisory:** https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
- **Rapid7 Analysis:** https://www.rapid7.com/blog/post/etr-cve-2025-20333-cve-2025-20362-cve-2025-20363-multiple-critical-vulnerabilities-affecting-cisco-products/
- **Zscaler ThreatLabz:** https://www.zscaler.com/blogs/security-research/cisco-firewall-and-vpn-zero-day-attacks-cve-2025-20333-and-cve-2025-20362
- **Tenable FAQ:** https://www.tenable.com/blog/cve-2025-20333-cve-2025-20362-faq-cisco-asa-ftd-zero-days-uat4356
---
## Disclaimer
**This toolkit is provided AS-IS for educational and authorized testing purposes only.**
- Use at your own risk
- No warranty or liability for misuse
- Unauthorized access is illegal
- Report findings responsibly to Cisco and affected organizations
- Follow your country's cybersecurity laws
---
**Created:** 2026-08-23
**Research Period:** 2026-08-22 to 2026-08-23
**Status:** Complete & Documented
**Classification:** Educational / Authorized Testing Only