CVE DatabaseCVE-2025-20362

Updated 2026-10-18한국어 권고문 →

CVE-2025-203628.6/HIGHCISA KEVCWE-862

Cisco Secure ASA and FTD VPN Web Server Authentication Bypass and DoS Vulnerability (CVE-2025-20362)

⚡ Jump to Patch

Affected Vendors

cisco

Affected Components

adaptive security appliance software, secure firewall threat defense software

Published Date

2025-09-25

CVSS v3.1

8.6

HIGH

EPSS (30d)

86.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software with Remote Access VPN enabled

Impact

Unauthenticated remote attackers can bypass authentication to access restricted VPN-related URL endpoints, and active exploit variants can trigger unexpected device reloads, causing a complete Denial of Service (DoS)

Mitigation

Immediately upgrade to the fixed software releases recommended in the official Cisco Security Advisory

Affected Products & Version Scope

All vulnerable versions of Cisco Secure Firewall ASA and FTD Software with Remote Access VPN (SSL VPN, etc.) enabled (refer to Cisco's advisory for specific fixed releases)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Perform a software upgrade to the recommended fixed release via the Cisco management console. Below is an example of upgrading the ASA image via TFTP in the CLI environment.

bash

# Access ASA CLI and enter privileged mode
enable
configure terminal

# Download the patched ASA image from your TFTP server
copy tftp://192.168.1.100/asa918-4-s15-k8.bin flash:/asa918-4-s15-k8.bin

# Update the boot system path and save configuration
no boot system disk0:/old-asa-image.bin
boot system disk0:/asa918-4-s15-k8.bin
write memory

# Reload the device to apply the patch
reload

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to the WebVPN interface to trusted source IP addresses only.

bash

# Define trusted administrator IP ranges
object-group network TRUSTED_ADMINS
 network-object 203.0.113.0 255.255.255.0
exit

# Restrict HTTP/HTTPS access on the outside interface
http 203.0.113.0 255.255.255.0 outside
no http 0.0.0.0 0.0.0.0 outside
write memory

3. Log Audit & IoC Verification Commands

Monitor system logs and crash history to detect potential exploitation attempts or unexpected reloads.

bash

# Check for recent system crashes and reload reasons\show crashinfo
show version | include System image file|Last reload reason

# Search for anomalous WebVPN access logs and HTTP requests
show log | include %ASA-6-716002|%ASA-4-716039|/webvpn/

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

This vulnerability is actively exploited in the wild (CISA KEV); immediately apply the official Cisco security updates to prevent potential DoS and unauthorized access.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-20362) is an authentication bypass flaw (CWE-862) residing in the VPN web server component of Cisco Secure Firewall ASA and FTD Software. The root cause is improper validation of user-supplied input in HTTP(S) requests. This allows an unauthenticated, remote attacker to bypass access control checks and access restricted URL endpoints associated with remote access VPN services.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by sending crafted HTTP requests directly to the targeted device's VPN web server port. By manipulating specific request parameters, the attacker bypasses the authentication validation logic to access restricted internal endpoints. Furthermore, active attack variants targeting this vulnerability alongside CVE-2025-20333 have been observed. If unpatched devices receive these malicious payloads, it can trigger memory corruption or unexpected system reloads, resulting in a persistent Denial of Service (DoS) condition.

3. Infrastructure & Business Impact

Since these firewalls act as critical perimeter gateways, successful exploitation can allow attackers to gain unauthorized access to sensitive VPN configurations or internal network entry points. Given its inclusion in the CISA KEV catalog and an extremely high EPSS score of 0.8669, this vulnerability is actively exploited in the wild. Failure to remediate this flaw immediately poses a severe risk of network-wide outages and business disruption.

Official Vendor Advisories & References

NVD Original English Description

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW

Source: psirt@cisco.com · Vendor Advisory

https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-20362)

FAQ

Q1. How critical is CVE-2025-20362 and is it actively exploited in the wild?

CVE-2025-20362 is rated CVSS 8.6 (HIGH) with a 30-day EPSS exploitation probability of 86.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-20362?

Primary impacted vendors include cisco across adaptive security appliance software, secure firewall threat defense software. Scope summary: All vulnerable versions of Cisco Secure Firewall ASA and FTD Software with Remote Access VPN (SSL VPN, etc.) enabled (refer to Cisco's advisory for specific fixed releases)

Q3. What temporary mitigations or workarounds exist for CVE-2025-20362 before patching?

[Mitigation] Immediately upgrade to the fixed software releases recommended in the official Cisco Security Advisory Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION