{"id":"CVE-2025-20362","published":"2025-09-25T16:15:32Z","modified":"2026-10-18T21:10:00Z","title":"Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization…","vendor":"Cisco","product":"Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense","tier":"core","eol":null,"description":{"text":"Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software [\"#fs\"] section of this advisory.\r\n\r A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.\r\n\r This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.","provenance":"source","from":"NVD"},"summary":{"text":"A missing-authorization flaw in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software lets restricted, remote-access VPN URL endpoints be reached without authentication. An unauthenticated remote attacker can exploit it over the network by sending crafted HTTP(S) requests to the device's web server, with no user interaction or prior configuration needed, to reach endpoints that should require authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:03:57Z"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.87085,"percentile":0.99749,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-09-25","dueDate":"2025-09-26","ransomware":false,"requiredAction":"The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ;   https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW ; https://nvd.nist.gov/vuln/detail/CVE-2025-20362","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-09-25","exploitedFirstSeen":"2025-09-25","ransomware":false,"evidence":[{"url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","date":"2025-09-25"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW","date":"2025-09-25"},{"url":"https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks","date":"2025-09-25"},{"url":"https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices","date":"2025-09-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-09-25"},{"url":"https://moje.cert.pl/komunikaty/2025/36/aktywnie-wykorzystywane-krytyczne-podatnosci-w-urzadzeniach-cisco-asa-i-cisco-firepower/","date":"2025-09-26"},{"url":"https://research.checkpoint.com/2025/29th-september-threat-intelligence-report/","date":"2025-09-29"},{"url":"https://blog.hunterstrategy.net/cisco-0-day-exploitation-arcanedoor-attribution-confirmed/","date":"2025-10-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-13&host_type=src&vulnerability=cve-2025-20362","date":"2025-10-13"},{"url":"https://www.recordedfuture.com/blog/september-2025-cve-landscape","date":"2025-10-17"}],"evidenceTotal":136,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW","tags":["Vendor Advisory"]},{"url":"https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated HTTP requests to exposed VPN web server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server","start":927,"end":1029}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Causes device reload, denial of service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions","start":216,"end":325}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-78e2285773915bb291c1","title":"ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","date":"2024-04-24","mentions":[{"quote":"*Update 2025-09-25: Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.","start":89,"end":314},{"quote":"UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.","start":23159,"end":23286}]},{"id":"SRC-29d0b86e8592bf01f10c","title":"Breaking the silence","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","date":"2022-12-08","mentions":[{"quote":"UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.","start":24304,"end":24431}]},{"id":"SRC-85c03a59069479556202","title":"TeamTNT Targeting AWS, Alibaba","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/","date":"2022-04-21","mentions":[{"quote":"UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.","start":31022,"end":31149}]},{"id":"SRC-65ab06ae92274f14e50e","title":"DNS Hijacking Abuses Trust In Core Internet Service","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/seaturtle/","date":"2019-04-17","mentions":[{"quote":"UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.","start":22006,"end":22133}]},{"id":"SRC-4a68d24205d7fc9a3e3d","title":"Cisco Event Response: Continued Attacks Against Cisco Firewalls","publisher":"sec.cloudapps.cisco.com","url":"https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks","date":null,"mentions":[{"quote":"Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362.","start":1537,"end":1752},{"quote":"The evidence collected strongly indicates that CVE-2025-20333 and CVE-2025-20362 were used by the attacker in the current attack campaign.","start":12242,"end":12380},{"quote":"CVE-2025-20362","start":13468,"end":13482},{"quote":"First Fixed Release forCVE-2025-20362 Medium","start":14018,"end":14062},{"quote":"First Fixed Release forCVE-2025-20362 Medium","start":14982,"end":15026}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-31139","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31139","exploited":true,"exploitedSince":"2025-09-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-05-16","earliestUrl":"https://github.com/curtishoughton/CVE-2025-20362-Cisco-Scanner","repos":[{"name":"curtishoughton/CVE-2025-20362-Cisco-Scanner","url":"https://github.com/curtishoughton/CVE-2025-20362-Cisco-Scanner","stars":1,"created":"2026-05-16"}]},"nuclei":[{"id":"CVE-2025-20362","name":"Cisco Secure Firewall ASA & FTD - Authentication Bypass","severity":"medium","path":"http/cves/2025/CVE-2025-20362.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20362.yaml"}],"first":{"date":"2026-05-16","source":"PoC-in-GitHub","url":"https://github.com/curtishoughton/CVE-2025-20362-Cisco-Scanner"},"provenance":"source"},"detections":{"cveRules":[{"title":"Cisco ASA Exploitation Activity - Proxy","id":"15697955-6a29-47ca-92e9-0e05efae3260","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-20333/proxy_exploit_cve_2025_20333.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-20333/proxy_exploit_cve_2025_20333.yml","techniques":["T1190"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2019-04-17","kind":"report","label":"Named in blog.talosintelligence.com: DNS Hijacking Abuses Trust In Core Internet Service","url":"https://blog.talosintelligence.com/seaturtle/","provenance":"machine"},{"date":"2022-04-21","kind":"report","label":"Named in blog.talosintelligence.com: TeamTNT Targeting AWS, Alibaba","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/","provenance":"machine"},{"date":"2022-12-08","kind":"report","label":"Named in blog.talosintelligence.com: Breaking the silence","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","provenance":"machine"},{"date":"2024-04-24","kind":"report","label":"Named in blog.talosintelligence.com: ArcaneDoor - New espionage-focused campaign found targeting perimeter network devi…","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","provenance":"machine"},{"date":"2025-09-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20362","provenance":"source"},{"date":"2025-09-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","provenance":"source"},{"date":"2025-09-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-09-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31139","provenance":"source"},{"date":"2026-05-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/curtishoughton/CVE-2025-20362-Cisco-Scanner","provenance":"source"}],"speed":{"daysToPublicExploit":233,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":79.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 401 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9975"},{"name":"Named in threat reports","points":10.0,"detail":"5 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.02,"detail":"base score 8.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}