{"id":995,"date":"2025-09-26T12:18:51","date_gmt":"2025-09-26T12:18:51","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/cisco-secure-firewall-adaptive-security-appliance-softver-i-secure-firewall-threat-defense-softver-ranjivost-vpn-web-posluzitelja-na-udaljeno-izvrsavanje-koda\/"},"modified":"2026-11-04T09:00:48","modified_gmt":"2026-11-04T09:00:48","slug":"cisco-secure-firewall-adaptive-security-appliance-softver-i-secure-firewall-threat-defense-softver-ranjivost-vpn-web-posluzitelja-na-udaljeno-izvrsavanje-koda","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/cisco-secure-firewall-adaptive-security-appliance-softver-i-secure-firewall-threat-defense-softver-ranjivost-vpn-web-posluzitelja-na-udaljeno-izvrsavanje-koda\/","title":{"rendered":"Cisco Secure Firewall Adaptive Security Appliance softver i Secure Firewall Threat Defense softver \u2013 ranjivost VPN web poslu\u017eitelja na udaljeno izvr\u0161avanje k\u00f4da"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>Sa\u017eetak<\/strong>\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVE-2025-20333<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span class=\"has-inline-color has-vivid-red-color\"><strong>CVSS - 9.9<\/strong><\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ranjivost u VPN web poslu\u017eitelju <strong>Cisco Secure Firewall Adaptive Security Appliance\u00a0 (ASA)<\/strong> <strong>i Cisco Secure Firewall Threat Defense (FTD)<\/strong> softvera mogla bi omogu\u0107iti autentificiranom udaljenom napada\u010du izvr\u0161avanje proizvoljnog k\u00f4da na ranjivom ure\u0111aju.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do ranjivosti dolazi zbog nepravilne provjere korisni\u010dkog unosa u HTTP(S) zahtjevima. Napada\u010d s va\u017ee\u0107im VPN korisni\u010dkim vjerodajnicama mogao bi iskoristiti ovu ranjivost slanjem posebno oblikovanih HTTP zahtjeva ranjivom ure\u0111aju. Uspje\u0161no iskori\u0161tavanje ranjivosti moglo bi napada\u010du omogu\u0107iti izvr\u0161avanje proizvoljnog k\u00f4da s <em>root<\/em> ovlastima, \u0161to mo\u017ee rezultirati potpunom kompromitacijom pogo\u0111enog ure\u0111aja.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco je objavio softverske nadogradnje koje otklanjaju ovu ranjivost. Cisco preporu\u010duje korisnicima nadogradnju na zakrpanu verziju softvera kako bi se ranjivost uklonila. Ne postoje privremena rje\u0161enja koja rje\u0161avaju ovu ranjivost.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ovaj savjet je dostupan na sljede\u0107oj poveznici:&nbsp;<br><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-asaftd-webvpn-z5xP8EUB\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-asaftd-webvpn-z5xP8EUB<\/a>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Za vi\u0161e informacija o ranjivosti opisanoj u ovom savjetu pogledajte: <a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/resources\/asa_ftd_continued_attacks\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms<\/em><\/a>.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<br><strong>Ranjivi proizvodi<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ova ranjivost utje\u010de na Cisco ure\u0111aje ako koriste ranjivu verziju Cisco Secure Firewall ASA softvera ili Cisco Secure FTD softvera te imaju jednu ili vi\u0161e ranjivih konfiguracija navedenih u sljede\u0107e dvije tablice.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Za informacije o tome koje verzije Cisco softvera su ranjive, pogledajte odjeljak <em>Zakrpani Software<\/em> u ovom savjetu.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ranjive konfiguracije Cisco Secure Firewall ASA softvera<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">U sljede\u0107oj tablici, lijevi stupac navodi zna\u010dajke Cisco Secure Firewall ASA softvera koje su potencijalno ranjive. Desni stupac pokazuje osnovnu konfiguraciju zna\u010dajke iz <em>show running-config CLI naredbe<\/em>, ako ju je mogu\u0107e odrediti. Ove zna\u010dajke mogu uzrokovati i da SSL listen socket-i budu omogu\u0107eni.&nbsp;<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af19eac9ce35&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af19eac9ce35\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2025\/09\/image-7.png\" alt=\"A screenshot of a computer programAI-generated content may be incorrect.\" class=\"wp-image-113076\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ranjive konfiguracije Cisco Secure Firewall FTD softvera<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">U sljede\u0107oj tablici, lijevi stupac navodi zna\u010dajke Cisco Secure Firewall FTD softvera koje su potencijalno ranjive. Desni stupac pokazuje osnovnu konfiguraciju zna\u010dajke iz show running-config CLI naredbe, ako ju je mogu\u0107e odrediti. Ove zna\u010dajke mogu uzrokovati da SSL listen socket-i budu omogu\u0107eni.&nbsp;<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af19eac9d3b3&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af19eac9d3b3\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2025\/09\/image-6.png\" alt=\"A screen shot of a computer codeAI-generated content may be incorrect.\" class=\"wp-image-113075\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Zna\u010dajke <strong>Remote Access VPN<\/strong> omogu\u0107uju se putem <strong>Devices &gt; VPN &gt; Remote Access<\/strong> u Cisco Secure Firewall Management Center (FMC) softveru ili putem <strong>Device &gt; Remote Access VPN<\/strong> u Cisco Secure Firewall Device Manager (FDM).&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Proizvodi za koje je potvr\u0111eno da nisu ranjivi<\/strong>&nbsp;<br>Samo proizvodi koji su navedeni u odjeljku <strong>Ranjivi proizvodi<\/strong> ovog savjeta mogu biti pogo\u0111eni ovom ranjivo\u0161\u0107u.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco je potvrdio da ova ranjivost <strong>ne utje\u010de na Cisco Secure FMC softver<\/strong>.&nbsp;<br>&nbsp;<br>Ne postoje privremena rje\u0161enja koja uklanjaju ovu ranjivost.&nbsp;<br>&nbsp;<br>Za potpuno uklanjanje ove ranjivosti i sprje\u010davanje budu\u0107e izlo\u017eenosti, kako je opisano u ovom savjetu, Cisco sna\u017eno preporu\u010duje korisnicima nadogradnju na zakrpanu verziju softvera.&nbsp;<br>&nbsp;<br><strong>Dodatne preporuke<\/strong>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nakon instalacije zakrpane verzije softvera, preporu\u010duje se da korisnici pregledaju odjeljak <strong>Configure Threat Detection for VPN Services<\/strong> u <strong>Cisco Secure Firewall ASA Firewall CLI Configuration Guide<\/strong>. &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco Product Security Incident Response Team (PSIRT) je svjestan poku\u0161aja iskori\u0161tavanja ove ranjivosti. Cisco i dalje sna\u017eno preporu\u010duje korisnicima nadogradnju na zakrpanu verziju softvera kako bi se uklonila ranjivost.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>#SurfajSigurnije<\/strong><\/p>","protected":false},"excerpt":{"rendered":"<p>Sa\u017eetak\u00a0 CVE-2025-20333 CVSS &#8211; 9.9 Ranjivost u VPN web poslu\u017eitelju Cisco Secure Firewall Adaptive Security Appliance\u00a0 (ASA) i Cisco Secure Firewall Threat Defense (FTD) softvera mogla bi omogu\u0107iti autentificiranom udaljenom napada\u010du izvr\u0161avanje proizvoljnog k\u00f4da na ranjivom ure\u0111aju.\u00a0 Do ranjivosti dolazi zbog nepravilne provjere korisni\u010dkog unosa u HTTP(S) zahtjevima. Napada\u010d s va\u017ee\u0107im VPN korisni\u010dkim vjerodajnicama mogao [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1582,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-995","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=995"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/995\/revisions"}],"predecessor-version":[{"id":1586,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/995\/revisions\/1586"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1582"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=995"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=995"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}