CVE-2025-20362

What it actually does

CVE-2025-20362 is an unauthenticated remote missing-authorization flaw in the VPN web server component of Cisco Secure Firewall ASA and Cisco Secure FTD. Because the device improperly validates user-supplied HTTP(S) request input, a remote attacker can send crafted requests to the VPN web interface and reach restricted remote-access VPN URL endpoints that should require authentication. Cisco has also reported an active attack variant affecting devices vulnerable to CVE-2025-20333 and CVE-2025-20362 that can trigger unexpected device reloads, causing denial-of-service conditions on unpatched firewalls.

Why it matters to the business

Successful exploitation can expose restricted VPN functionality to unauthenticated internet users and may disrupt firewall or VPN availability through unexpected reloads. For organizations that rely on Cisco ASA or FTD for remote access, perimeter security, branch connectivity, or traffic inspection, exploitation can result in VPN outages, degraded network access, incident response workload, and increased risk of follow-on compromise. The issue is listed in CISA KEV, has active exploitation in the wild, a high EPSS score of 0.85543, and a CISA remediation due date of 2025-09-26, making unpatched internet-facing deployments high-priority risk.

How an attack unfolds

An attacker first identifies internet-facing Cisco ASA or FTD devices with the remote-access VPN web service exposed over HTTPS. The attacker then sends crafted HTTP requests to the VPN web server that manipulate request input in a way the device fails to validate correctly. If the target is vulnerable, the request reaches restricted VPN-related URL endpoints without a valid authenticated VPN session. In observed activity, including campaigns tracked around ArcaneDoor and September 2025 active exploitation activity, attackers have targeted Cisco perimeter appliances because they are exposed, security-critical, and often highly trusted. Cisco has also warned of a newer attack variant against devices affected by CVE-2025-20333 and CVE-2025-20362 that can cause unpatched ASA or FTD devices to unexpectedly reload, resulting in denial of service. After gaining access to restricted endpoints, an attacker may attempt reconnaissance of VPN behavior, chaining with other vulnerabilities, disruption of VPN services, or repeated requests designed to destabilize the appliance.

How to fix it

Upgrade affected Cisco Secure ASA Software and Cisco Secure FTD Software to the fixed releases listed in Cisco’s official advisory Fixed Software section for CVE-2025-20362 and related guidance for CVE-2025-20333. No exact fixed versions were provided in the input, so administrators should verify the correct target release for each appliance model, software train, and deployment mode directly against Cisco’s advisory and release notes. Prioritize all internet-facing ASA/FTD appliances with remote-access VPN enabled. If immediate upgrade is not possible, reduce exposure by restricting access to the VPN web interface to trusted source networks where operationally feasible, disabling unused remote-access VPN features, applying compensating perimeter controls, monitoring for abnormal WebVPN requests, and preparing for possible failover or reload events. Mitigations should be treated as temporary; the durable fix is installation of Cisco’s fixed software release.

How to confirm the fix worked

Confirm remediation by inventorying all Cisco ASA and FTD appliances, recording their running software versions, and comparing them against Cisco’s fixed software matrix for CVE-2025-20362. Verify that every internet-facing device with remote-access VPN or WebVPN enabled is on a fixed release. Validate externally that only intended VPN services are reachable and that restricted VPN endpoints require authentication rather than returning successful unauthenticated responses. Review Cisco FMC, ASA CLI, change records, and software image metadata to confirm the upgraded image is active after reboot or failover. For high-availability pairs, validate both active and standby units. After patching, monitor for continued abnormal VPN web requests and unexpected reloads to confirm exploitation attempts no longer produce unauthorized access or service disruption.

Typical attack path

1. Scan the internet or known network ranges for Cisco ASA or Cisco FTD devices exposing remote-access VPN web services over HTTPS.
2. Fingerprint the VPN web interface using Cisco ASA/FTD WebVPN URL patterns, TLS characteristics, banners, or web content.
3. Send crafted unauthenticated HTTP(S) requests to VPN web server paths associated with restricted remote-access VPN functionality.
4. Observe whether restricted endpoints respond without a valid authenticated VPN session, indicating the device is vulnerable.
5. Use the unauthorized access to enumerate VPN-related behavior, attempt additional endpoint interactions, or chain with other Cisco ASA/FTD vulnerabilities.
6. In the newer observed attack variant, send requests that trigger unexpected appliance reloads, causing firewall or VPN service disruption.

How to detect it

To determine whether exploitation already occurred, review Cisco ASA/FTD VPN web server logs, syslog, Cisco FMC events, VPN authentication logs, reverse proxy logs if present, NetFlow, firewall connection logs, crashinfo files, core files, and device reload history. Look for unauthenticated external clients making repeated or malformed requests to Cisco WebVPN URL paths, especially requests that access restricted resources without a corresponding successful VPN login. Correlate suspicious HTTPS requests with device instability, failover events, crashinfo creation, or unexpected reloads. Investigate spikes in 4xx/5xx responses, unusual access to /+CSCOE+/ or /+webvpn+/ paths, requests from unfamiliar countries or hosting providers, and any timeline overlap with known ArcaneDoor or September 2025 Cisco exploitation campaign infrastructure reported by threat intelligence providers. Because the vulnerability does not have a single universal file artifact or payload string, detection should combine URI-pattern hunting, unauthenticated-session analysis, source reputation, and appliance health events.

• /+CSCOE+/
• /+webvpn+/
• GET /+CSCOE+/
• POST /+CSCOE+/
• GET /+webvpn+/
• POST /+webvpn+/
• webvpn
• unexpected reload
• crashinfo
• core dump
• Traceback
• CVE-2025-20362
• CVE-2025-20333

What your security team should do

• Immediately identify all Cisco ASA and Cisco FTD appliances exposed to the internet, especially those with remote-access VPN enabled.
• Treat unpatched systems as urgent because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and has a high EPSS probability.
• Upgrade to Cisco’s fixed ASA/FTD releases from the official advisory; confirm both active and standby HA units are remediated.
• Review logs and device telemetry for historical exploitation attempts before and after the patch window, focusing on WebVPN HTTP requests, unauthenticated access attempts, and unexpected reloads.
• If upgrades cannot be completed immediately, restrict VPN web service exposure to trusted networks or access paths and disable unused VPN features until patching is complete.
• Prepare operational contingency plans for affected perimeter devices, including failover validation, configuration backups, and out-of-band management access in case of unexpected reloads.
• Correlate activity with threat intelligence related to ArcaneDoor and September 2025 Cisco exploitation campaigns, but do not rely solely on named-actor indicators because exploitation may be widespread.
• Add detections for suspicious Cisco ASA/FTD WebVPN URI access patterns and unusual HTTP status behavior from unauthenticated clients.