CVE-2025-20362

8.6

HIGH CVSS 3.1

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability - [Actively Exploited]

Description

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

INFO

Published Date :

Sept. 25, 2025, 4:15 p.m.

Last Modified :

Nov. 6, 2025, 2:51 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Sep 26, 2025

Alert Date: Sep 25, 2025 | 63 days ago

Description :

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

Required Action :

The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ; https://nvd.nist.gov/vuln/detail/CVE-2025-20362

Affected Products

The following products are affected by CVE-2025-20362 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Cisco	adaptive_security_appliance_software
2	Cisco	firepower_threat_defense

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	MEDIUM				[email protected]
	CVSS 3.1	HIGH				[email protected]

Solution

Address improper validation of HTTP requests to prevent unauthorized access to restricted URLs.

Update Cisco Secure Firewall ASA and FTD software.
Validate all user input in HTTP requests.
Restrict access to sensitive URL endpoints.
Implement robust authentication controls.

Public PoC/Exploit Available at Github

CVE-2025-20362 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-20362.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW	Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20362 is associated with the following CWEs:

CWE-862: Missing Authorization

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20362 weaknesses.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws Exploitation of Thunderbolt Protection Flaws

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

callinston/Cisco-ASA-FTD

None

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Oct. 8, 2025, 8:38 p.m. This repo has been linked 2 different CVEs too.

dataclean-saas/API---Hole

A diagnostic security platform that demonstrates the critical importance of timely security updates

HTML

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : Sept. 28, 2025, 2:15 p.m. This repo has been linked 2 different CVEs too.

abdulmyid-cyber/SIEM-Content

Zero Day SIgma rules

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : Sept. 26, 2025, 6:28 p.m. This repo has been linked 3 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-20362 vulnerability anywhere in the article.

Help Net Security

Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Adopting a counterintelligence mindset in luxury logistics In this Help Net Security interview, Andrea ...

Published Date: Nov 16, 2025 (1 week, 4 days ago)

The Hacker News

RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet

Nov 15, 2025Ravie LakshmananMalware / Vulnerability The botnet malware known as RondoDox has been observed targeting unpatched XWiki instances against a critical security flaw that could allow attac ...

Published Date: Nov 15, 2025 (1 week, 4 days ago)

hackread.com

CISA Warns of Active Attacks on Cisco ASA and Firepower Flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a strong warning regarding critical vulnerabilities in Cisco’s Adaptive Security Appliances (ASA) and Firepower devices, which ...

Published Date: Nov 14, 2025 (1 week, 5 days ago)

The Cyber Express

Akira Ransomware Group Poses ‘Imminent Threat’ to Critical Infrastructure: CISA

The Akira ransomware group poses an “imminent threat to critical infrastructure,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned today. CISA joined with the FBI, other U.S. ag ...

Published Date: Nov 13, 2025 (1 week, 6 days ago)

Help Net Security

“Patched” but still exposed: US federal agencies must remediate Cisco flaws (again)

CISA has ordered US federal agencies to fully address two actively exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362) in Cisco Adaptive Security Appliances (ASA) and Firepower firewalls. “In C ...

Published Date: Nov 13, 2025 (1 week, 6 days ago)

BleepingComputer

CISA warns feds to fully patch actively exploited Cisco flaws

CISA warned U.S. federal agencies to fully patch two actively exploited vulnerabilities in Cisco Adaptive Security Appliances (ASA) and Firepower devices. Tracked as CVE-2025-20362 and CVE-2025-20333, ...