CVE-2025-20362: Cisco Secure Firewall ASA and FTD missing authorization in VPN web server

CVE-2025-20362 · Severity: critical · CVSS 6.5 · Exploited in the wild · Published 2025-09-25

Cisco Secure Firewall devices, which are used to provide secure remote access and network protection, contain a security flaw in their VPN web server component. An unauthorized attacker can bypass security checks to access restricted areas of the management interface or cause the device to crash and reboot. This vulnerability is actively being exploited in the wild and can lead to a total loss of network connectivity for the organization.

Technologies: Cisco Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Adaptive Security Appliance, Cisco Secure Firewall Threat Defense, Cisco Secure Firewall Threat Defense (FTD). Vendors: Cisco.

Quick answers

Is CVE-2025-20362 exploited in the wild?
Yes. CVE-2025-20362 is known to be exploited in the wild, first recorded on 25 September 2025. Treat it as urgent.
How severe is CVE-2025-20362?
Critical severity, with a CVSS score of 6.5, published 25 September 2025.
Which products and versions are affected?
Cisco Secure Firewall Adaptive Security Appliance (ASA); Cisco Secure Firewall Threat Defense (FTD).
Is there a fix for CVE-2025-20362?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-20362 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-20362?
Check whether you run Cisco Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Adaptive Security Appliance, Cisco Secure Firewall Threat Defense or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the VPN web server of Cisco ASA and FTD software due to improper validation of user-supplied input in HTTP(S) requests. A remote, unauthenticated attacker can exploit this by sending crafted HTTP requests to access restricted URL endpoints related to remote access VPN. Furthermore, a variant of this attack can trigger an unexpected device reload, resulting in a denial-of-service (DoS) condition. This vulnerability has been observed being chained with other flaws and is actively exploited in the wild. Cisco has released software updates to address this issue.

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance (ASA)
  • Cisco Secure Firewall Threat Defense (FTD)

Timeline

  • 2025-09-25: disclosed: Initial disclosure and CISA KEV addition
  • 2025-09-25: kev added
  • 2025-11-05: other: Cisco updated advisory to include details on a new DoS attack variant

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.