CVE-2025-20362

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization

6.5 MEDIUMActively exploited (CISA KEV)EPSS 87.1%

Published25 Sept 2025
Added to CISA KEV25 Sept 2025
Remediation due26 Sept 2025

Description

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Cisco Secure Firewall Threat Defense≥ 7.0.0 < 7.0.8.1 · ≥ 7.1.0 < 7.2.10.2 · ≥ 7.3.0 < 7.4.2.4 · ≥ 7.6.0 < 7.6.2.1

Cisco Adaptive Security Appliance Software≥ 9.12 < 9.12.4.72 · ≥ 9.14 < 9.14.4.28 · ≥ 9.16 < 9.16.4.85 · ≥ 9.17.0 < 9.18.4.67

Remediation

Fixed in

Cisco Secure Firewall Threat Defense≥ 7.0.8.1

Cisco Adaptive Security Appliance Software≥ 9.12.4.72

Patch & vendor advisories

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUWVendor Advisory
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacksVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-20362 being actively exploited?

Yes. CVE-2025-20362 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Sept 2025.

How severe is CVE-2025-20362?

CVE-2025-20362 has a CVSS 3.1 base score of 6.5, rated medium. EPSS estimates a 87.1% probability of exploitation.

Which products are affected by CVE-2025-20362?

Affected products include Cisco Secure Firewall Threat Defense, Cisco Adaptive Security Appliance Software.

How do I fix CVE-2025-20362?

Upgrade affected software to a fixed version, for example Cisco Secure Firewall Threat Defense 7.0.8.1, Cisco Adaptive Security Appliance Software 9.12.4.72 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-20362 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.