CVE-2025-20362

CVE-2025-20362 is a missing-authorization flaw (CWE-862) in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that allows an unauthenticated, remote attacker to reach restricted URL endpoints related to remote access VPN that should otherwise require authentication. It is triggered by sending crafted HTTP(S) requests to the targeted device's web server, exploiting improper validation of user-supplied input; a successful exploit grants access to restricted URLs without any credentials. Any organization running an affected ASA or FTD release with the VPN web server enabled, particularly internet-exposed remote access VPN endpoints, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-09-25, carries an EPSS exploitation probability of 87.1%, and Cisco reported on 2025-11-05 that a new attack variant, together with CVE-2025-20333, can cause unpatched devices to unexpectedly reload and suffer denial of service. The UK NCSC has warned that attackers exploited these Cisco firewall zero-days to deploy RayInitiator and LINE VIPER malware, and US federal agencies are required to remediate under CISA Emergency Directive 25-03.

What to do: Upgrade all ASA and FTD devices to the fixed releases listed in the Fixed Software section of Cisco's advisory; per the 2025-11-05 update, unpatched devices face an active attack variant chained with CVE-2025-20333 that can reload devices, so prioritize internet-facing VPN concentrators. If upgrading is not immediately possible, follow the mitigation steps in CISA Emergency Directive 25-03 and Cisco's guidance (such as restricting or disabling the VPN web server) and hunt for indicators of compromise, including RayInitiator/LINE VIPER malware artifacts described in UK NCSC reporting.