CVE-2025-20362
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
Description
CVE-2025-20362 is a medium-severity improper access control vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw allows an unauthenticated, remote attacker to access restricted URL endpoints related to remote access VPN that should require authentication. With a CVSS v3.1 base score of 6.5, the vulnerability is remotely exploitable with no authentication and low complexity. CISA issued Emergency Directive 25-03 and added CVE-2025-20362 to the KEV catalog with an accelerated remediation deadline of September 26, 2025, and the EPSS score of 42.31% at the 97th percentile indicates very high exploitation probability, reflecting the critical nature of VPN infrastructure compromise.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive security appliance software | >= 9.12, < 9.12.4.72; >= 9.14, < 9.14.4.28; >= 9.16, < 9.16.4.85; >= 9.17.0, < 9.18.4.67; >= 9.19, < 9.20.4.10; >= 9.22, < 9.22.2.14; >= 9.23, < 9.23.1.19 |
| cisco | secure firewall threat defense | >= 7.0.0, < 7.0.8.1; >= 7.1.0, < 7.2.10.2; >= 7.3.0, < 7.4.2.4; >= 7.6.0, < 7.6.2.1; >= 7.7.0, < 7.7.10.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW(Vendor Advisory)
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362(US Government Resource)
Weakness Type
CWE-862: Missing Authorization
CVE-2025-20362 is classified under CWE-862 (Missing Authorization), a weakness where the software does not perform an authorization check when an actor attempts to access a resource or perform an action. In the Cisco ASA and FTD VPN web server, certain URL endpoints associated with remote access VPN functionality fail to verify that the requesting user has been properly authenticated, allowing unauthenticated access to restricted resources.
Learn more: CWE-862 — Missing Authorization
Impact Analysis
CVE-2025-20362 carries a CVSS v3.1 base score of 6.5 (Medium severity), but its real-world impact is amplified by the critical role of VPN infrastructure in enterprise security. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality faces low impact as the attacker can access restricted VPN-related URL endpoints that may reveal configuration data, session information, or internal network details. Integrity is impacted at a low level because the unauthorized access to VPN management endpoints could allow an attacker to manipulate VPN settings or configurations. Cisco has noted that a new attack variant discovered in November 2025 can cause unpatched devices to unexpectedly reload, introducing a denial-of-service dimension. The EPSS score of 42.31% at the 97th percentile places this among the top 3% of vulnerabilities in exploitation probability, and CISA's issuance of Emergency Directive 25-03 with only a one-day remediation deadline underscores the urgency of addressing this Cisco ASA and FTD vulnerability.
Exploit Maturity
CVE-2025-20362 demonstrates very high exploit maturity, evidenced by CISA's issuance of Emergency Directive 25-03, which mandated an accelerated remediation timeline for federal agencies. CISA has confirmed active exploitation of this Cisco ASA and FTD vulnerability by adding it to the KEV catalog. The EPSS score of 42.31% at the 97th percentile places it among the most actively targeted vulnerabilities. Cisco has documented continued attacks against ASA and FTD devices in their resource page on continued attacks, indicating sustained threat actor interest. In November 2025, Cisco identified a new attack variant that can cause unpatched devices to reload, demonstrating evolving exploitation techniques. No public exploit code has been tagged in the available references, but the combination of active exploitation, emergency directives, and evolving attack variants makes this an extremely high-priority vulnerability.
Remediation
-
Follow CISA Emergency Directive 25-03 and apply Cisco's recommended patches immediately. For ASA Software, upgrade to fixed versions: 9.12.4.72+, 9.14.4.28+, 9.16.4.85+, 9.18.4.67+, 9.20.4.10+, 9.22.2.14+, or 9.23.1.19+ depending on your release train. For FTD Software, upgrade to: 7.0.8.1+, 7.2.10.2+, 7.4.2.4+, 7.6.2.1+, or 7.7.10.1+.
-
Review Cisco's advisory at cisco-sa-asaftd-webvpn-YROOTUW for specific version guidance, interim workarounds, and indicators of compromise.
-
Implement web server access restrictions to limit who can reach the VPN web server endpoints. Use access control lists to restrict access to the RAVPN web interface from trusted IP ranges only, where operationally feasible.
-
Monitor VPN infrastructure logs for unauthorized access attempts to restricted URL endpoints. Look for HTTP requests to VPN-related URIs from unexpected source addresses or without valid session tokens. Review device stability logs for unexpected reloads that may indicate the November 2025 attack variant.
-
Assess the VPN environment for compromise indicators by checking for unauthorized configuration changes, new user accounts, or unusual VPN session activity. Cisco's continued attacks resource page provides additional threat intelligence and indicators to review.
Technical Details
CVE-2025-20362 is a missing authorization vulnerability (CWE-862) in the VPN web server of Cisco ASA and FTD Software. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects a network-accessible attack requiring no authentication or user interaction, with low confidentiality and integrity impact. The vulnerability resides in the HTTP(S) request handling logic of the VPN web server component. When the device processes incoming HTTP requests directed at remote access VPN endpoints, it fails to properly validate whether the requesting user has been authenticated before granting access to restricted URL paths. By sending crafted HTTP requests to the targeted web server, an attacker can bypass the authentication requirement and access VPN-related resources that should only be available to authenticated users. The improper validation of user-supplied input in HTTP(S) requests enables this bypass. Cisco disclosed in November 2025 that a new attack variant targeting the same underlying flaw (in conjunction with CVE-2025-20333) can cause unpatched devices to unexpectedly reload, escalating the impact from information disclosure to denial of service.
Frequently Asked Questions
Is CVE-2025-20362 being actively exploited?
Yes. CISA has confirmed active exploitation and issued Emergency Directive 25-03 with an accelerated one-day remediation deadline. The EPSS score of 42.31% at the 97th percentile further confirms widespread exploitation. Cisco has documented ongoing attack campaigns against ASA and FTD devices.
What products are affected by CVE-2025-20362?
Cisco Secure Firewall ASA Software versions 9.12 through 9.23 and Cisco Secure Firewall Threat Defense (FTD) Software versions 7.0 through 7.7 are affected. Specific fixed versions are available for each release train.
How do I fix CVE-2025-20362?
Upgrade Cisco ASA or FTD Software to the fixed releases specified in Cisco advisory cisco-sa-asaftd-webvpn-YROOTUW. As an interim measure, restrict access to the VPN web server endpoints to trusted IP ranges using ACLs.
How severe is CVE-2025-20362?
CVE-2025-20362 has a CVSS v3.1 base score of 6.5 (Medium), but the operational impact is significant given the critical role of VPN infrastructure. CISA's emergency directive treatment and the November 2025 DoS attack variant elevate the real-world risk well beyond the base CVSS score.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.