CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: yes — in CISA KEV since 2025-09-25
EPSS: 87.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-25 · updated 2026-10-18
Weakness: CWE-862

Description

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

Summary

CVE-2025-20362 is a missing authorization flaw in the VPN web server of Cisco Secure Firewall ASA and FTD Software, caused by improper validation of user-supplied input in HTTP(S) requests. An unauthenticated remote attacker can send crafted requests to reach restricted remote-access VPN URL endpoints, and Cisco reports an attack variant that can force unpatched devices to reload, causing denial of service. It affects Cisco ASA Software (fixed in 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67) and Cisco FTD Software (fixed in 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1). The flaw is listed in CISA KEV with active exploitation, a public exploit exists, and EPSS gives an 87.1% chance of exploitation in 30 days. Upgrade to the fixed releases immediately and follow CISA and vendor mitigation guidance.

CVE-2025-20362 ثغرة نقص في التفويض ضمن خادم الويب الخاص بـ VPN في برمجيات Cisco Secure Firewall ASA وFTD، سببها تحقق غير صحيح من مدخلات المستخدم في طلبات HTTP(S). يستطيع مهاجم بعيد غير مصادَق إرسال طلبات مُصمَّمة للوصول إلى نقاط URL مقيَّدة خاصة بـ VPN الوصول عن بُعد، وقد أبلغت Cisco عن نسخة هجوم تُسبب إعادة تحميل غير متوقعة للأجهزة غير المُرقَّعة ما يؤدي إلى حجب الخدمة. تتأثر برمجيات Cisco ASA Software (تم الإصلاح في 9.12.4.72 و9.14.4.28 و9.16.4.85 و9.18.4.67) وCisco FTD Software (تم الإصلاح في 7.0.8.1 و7.2.10.2 و7.4.2.4 و7.6.2.1). الثغرة مدرجة في CISA KEV مع استغلال نشط، ويوجد استغلال عام، وتبلغ احتمالية الاستغلال خلال 30 يوماً وفق EPSS نسبة 87.1%. يجب الترقية فوراً إلى الإصدارات المُصلَحة واتباع إرشادات CISA والمورّد للتخفيف.

Affected products

Cisco ASA Software: from 9.12 before 9.12.4.72; from 9.14 before 9.14.4.28; from 9.16 before 9.16.4.85; from 9.17.0 before 9.18.4.67; from 9.19 before 9.20.4.10; from 9.22 before 9.22.2.14 — fixed in 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14
Cisco Firepower Threat Defense Software: from 7.0.0 before 7.0.8.1; from 7.1.0 before 7.2.10.2; from 7.3.0 before 7.4.2.4; from 7.6.0 before 7.6.2.1; from 7.7.0 before 7.7.10.1 — fixed in 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1

How to fix

Upgrade to a fixed version: Cisco ASA Software 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67; Cisco Firepower Threat Defense Software 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-20362 or the next vulnerability affects your stack