CVE-2025-20362

6.5

MEDIUM CVSS 3.1

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability - [Actively Exploited]

Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

INFO

Published Date :

Sept. 25, 2025, 4:15 p.m.

Last Modified :

Sept. 26, 2025, 7:26 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Sep 26, 2025

Alert Date: Sep 25, 2025 | 21 days ago

Description :

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

Required Action :

The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ; https://nvd.nist.gov/vuln/detail/CVE-2025-20362

Affected Products

The following products are affected by CVE-2025-20362 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Cisco	adaptive_security_appliance_software
2	Cisco	firepower_threat_defense

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	MEDIUM				[email protected]

Solution

Address improper validation of HTTP requests to prevent unauthorized access to restricted URLs.

Update Cisco Secure Firewall ASA and FTD software.
Validate all user input in HTTP requests.
Restrict access to sensitive URL endpoints.
Implement robust authentication controls.

Public PoC/Exploit Available at Github

CVE-2025-20362 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-20362.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW	Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20362 is associated with the following CWEs:

CWE-862: Missing Authorization

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20362 weaknesses.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws Exploitation of Thunderbolt Protection Flaws

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

callinston/Cisco-ASA-FTD

None

Updated: 1 week ago

0 stars 0 fork 0 watcher

Born at : Oct. 8, 2025, 8:38 p.m. This repo has been linked 2 different CVEs too.

dataclean-saas/API---Hole

A diagnostic security platform that demonstrates the critical importance of timely security updates

HTML

Updated: 2 days, 8 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 28, 2025, 2:15 p.m. This repo has been linked 2 different CVEs too.

abdulmyid-cyber/SIEM-Content

Zero Day SIgma rules

Updated: 1 day, 2 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 26, 2025, 6:28 p.m. This repo has been linked 3 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-20362 vulnerability anywhere in the article.

CybersecurityNews

Senate Investigates Cisco Over Zero-Day Firewall Vulnerabilities

U.S. Senator Bill Cassidy, Chairman of the Senate Health, Education, Labor, and Pensions (HELP) Committee, has demanded answers from Cisco Systems regarding recent zero-day vulnerabilities in its wide ...

Published Date: Oct 16, 2025 (4 hours, 56 minutes ago)

The Register

Senator presses Cisco over firewall flaws that burned US agency

US Senator Bill Cassidy has fired off a pointed letter to Cisco over the firewall flaws that allegedly let hackers breach "at least one federal agency." Cassidy's letter [PDF] to Cisco CEO Chuck Robbi ...

Published Date: Oct 16, 2025 (5 hours, 50 minutes ago)

security.nl

Amerikaanse senator wil meer informatie van Cisco over aangevallen lekken

De Amerikaanse senator Bill Cassidy wil dat Cisco meer informatie geeft over twee aangevallen kwetsbaarheden, zo blijkt uit een open brief aan Cisco-topman Chuck Robbins. Aanleiding voor het verzoek i ...

Published Date: Oct 16, 2025 (8 hours, 11 minutes ago)

Daily CyberSecurity

DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk Attacks

Cisco Talos has confirmed that ransomware operators are now abusing Velociraptor, an open-source digital forensics and incident response (DFIR) tool, in live ransomware campaigns. “Ransomware operator ...

Published Date: Oct 10, 2025 (6 days, 16 hours ago)

Daily CyberSecurity

ClickFix Phishing: New Automated Kits Trick Users Into Manually Running Malware and Stealers

Researchers from Palo Alto Networks Unit 42 have discovered a new phishing trend where attackers trick victims into manually executing malware on their own devices. The report exposes a commoditized p ...

Published Date: Oct 10, 2025 (6 days, 18 hours ago)

Daily CyberSecurity

TP-Link Router Flaw CVE-2023-28760 Allows Root RCE via LAN, PoC Available

Security researcher Rocco Calvi detailed a critical flaw in the TP-Link AX1800 WiFi 6 Router (Archer AX21/AX20) that allows attackers on the local network to achieve remote code execution (RCE) as the ...

Published Date: Oct 10, 2025 (6 days, 18 hours ago)

Daily CyberSecurity

GitHub Adds Sign in with Apple for Seamless Login and Anonymous Email Protection

The code-hosting platform GitHub recently introduced Google account sign-in, allowing users to log in swiftly using their Google credentials. This feature is particularly convenient for Chrome users, ...