CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

CISA Known Exploited Vulnerabilities

Name

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Vendor

Cisco

Product

Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

Added to the catalog

2025-09-25

Due date for US federal agencies

2025-09-26

Weaknesses

CWE-862

Catalog version

2026.10.30

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

Required action (CISA)

The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
• https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions
• https://www.cisa.gov/eviction-strategies-tool/create-from-template
• https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
• https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
• https://nvd.nist.gov/vuln/detail/CVE-2025-20362

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2025-09-25T16:15:32.280

Last modified

2026-10-18T21:10:00.120

Weaknesses

CWE-862

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory.
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.
This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW (Vendor Advisory)
• https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks (Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:42:22.836Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-20362

CVE record

Assigner

cisco

State

PUBLISHED

Published

2025-09-25T16:12:35.916Z

Updated

2026-02-26T17:47:57.719Z

Problem types

Missing Authorization

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory.
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.
This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

References

• cisco-sa-asaftd-webvpn-YROOTUW

Read on 2026-11-03T02:14:59.189Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/20xxx/CVE-2025-20362.json

Detection rules (SigmaHQ)

SigmaHQ rules whose own tags name this CVE. Each rule page shows the rule as its author published it.

• Cisco ASA Exploitation Activity - Proxy (status experimental, level high)

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/