CVE-2025-20362: Cisco Secure Firewall ASA/FTD VPN web server missing authorization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is an unauthenticated, remotely reachable missing-authorization issue in edge firewall VPN services, is listed in CISA KEV, and has a very high EPSS score with a documented DoS attack variant.

What it is

The VPN web server in Cisco Secure Firewall ASA and FTD software fails to properly validate user-supplied input in HTTP(S) requests, allowing access to restricted remote-access VPN URL endpoints without authentication. Cisco later reported an attack variant that can also cause unpatched devices to reload, producing denial-of-service conditions. Because these devices sit at the network edge and the flaw is remotely reachable without credentials, it is a serious exposure for unpatched firewalls.

Impact

An unauthenticated remote attacker can reach restricted VPN-related URL endpoints that should require authentication, and a newer attack variant can force unpatched devices to reload, causing a denial of service. The CVSS vector rates confidentiality and integrity impact as low and availability impact as high.

Attack surface

Reached over the network through crafted HTTP(S) requests sent to the VPN web server on the targeted ASA or FTD device. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2025-20362 is listed in CISA KEV with a 2025-09-25 addition date, and EPSS shows a 30-day probability of 0.87085 (99.7th percentile), indicating observed exploitation and high likelihood of further attempts. Cisco references confirm continued attacks against affected ASA and FTD devices.

What to do

• Upgrade to the fixed ASA and FTD software releases listed in Cisco's advisory Fixed Software section as the primary remediation.
• If immediate upgrade is not possible, apply the mitigation steps in Cisco's continued-attacks guidance and CISA's Emergency Directive 25-03 guidance, or discontinue use of the affected product.
• Restrict management and VPN web server access to trusted networks and known source addresses where operationally feasible.
• Monitor Cisco's advisory and CISA KEV entry for updated guidance, including the November 5, 2025 attack variant.
• Track patching against the KEV due date and verify all internet-facing ASA/FTD instances are covered.

Detection

• Inspect HTTP(S) request logs on ASA/FTD VPN web servers for crafted requests targeting restricted remote-access VPN URL endpoints without prior authentication.
• Alert on unexpected device reloads or restarts of ASA/FTD appliances that cannot be explained by maintenance or power events.
• Correlate VPN web server access from unusual or untrusted source IPs with requests to endpoints that normally require authentication.
• Review Cisco advisory and CISA guidance for specific indicators and hunt for the described attack variant against unpatched devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.