WaratekVRT Sign in

CVE-2025-20362 Cisco Secure Firewall Threat Defense

Affected softwareCisco Secure Firewall Threat Defense
Severity8.6 High CVSS 3.1 2 scores
WeaknessMissing authorization (CWE-862)
Published25 Sep 2025
Updated18 Oct 2026

Description

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2025-09-25 · remediation due 2025-09-26 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 26 citations · honeypot sightings · earliest 2025-09-25.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2026-05-16.
  • EPSS 87% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2025-20362 in VulnCheck (free account), which lists 21 more citations not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 121 days 2025-10-13 to 2026-11-13
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 21 days 2025-10-17 to 2026-11-02
Reported exploitation blog.talosintelligence.com /arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices 2025-09-25
Reported exploitation sec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW 2025-09-25
Reported exploitation sec.cloudapps.cisco.com /security/center/resources/asa_ftd_continued_attacks 2025-09-25
Reported exploitation cisa.gov /news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices 2025-09-25
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2025-09-25

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Safe Python scanner for CVE-2025-20362 (Cisco ASA/FTD WebVPN Authentication Bypass) 1 2026-05-16
Nuclei Cisco Secure Firewall ASA & FTD - Authentication Bypass

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (cisco/secure_firewall_threat_defense). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

8.6 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H NVD Primary published
CVSS 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N psirt@cisco.com Secondary

Affected software and releases

Products and versions

2 products, 12 version entries
SourceVendorProductSchemeAffected versions
nvd cisco adaptive security appliance software generic ≥ 9.12 and ＜ 9.12.4.72 · ≥ 9.14 and ＜ 9.14.4.28 · ≥ 9.16 and ＜ 9.16.4.85 · ≥ 9.17.0 and ＜ 9.18.4.67 · ≥ 9.19 and ＜ 9.20.4.10 · ≥ 9.22 and ＜ 9.22.2.14 · ≥ 9.23 and ＜ 9.23.1.19
nvd cisco secure firewall threat defense generic ≥ 7.0.0 and ＜ 7.0.8.1 · ≥ 7.1.0 and ＜ 7.2.10.2 · ≥ 7.3.0 and ＜ 7.4.2.4 · ≥ 7.6.0 and ＜ 7.6.2.1 · ≥ 7.7.0 and ＜ 7.7.10.1

References

URLTags
https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions
https://www.cisa.gov/eviction-strategies-tool/create-from-template
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362 US Government Resource

Timeline
Published2025-09-25By the CVE Program.
Added to CISA KEV2025-09-25Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2025-09-25Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-10-18NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-13Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.