CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

CVE-2025-20362 is a missing authorization vulnerability in the VPN web server component of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Because these products commonly sit at the network edge and terminate remote-access VPN sessions, an unauthenticated or under-authorized attacker who can reach the VPN web interface may be able to perform actions that should require proper authorization. The issue can also be chained with CVE-2025-20333, increasing the potential impact. Organizations that rely on ASA or FTD for perimeter security should treat this as a high-priority review item and confirm exact exposure against Cisco’s advisory.

How it works

The flaw is classified as CWE-862 (Missing Authorization). In essence, the VPN web server fails to enforce authorization checks on certain requests. An attacker who can send traffic to the exposed VPN web service may invoke functionality or obtain information that the product design intends only for authorized users. Public detail on the precise request paths or parameters is limited; defenders should not assume a particular exploit technique and must rely on the vendor advisory for the authoritative description. Because the component is network-facing, successful abuse could allow an attacker to pivot further, especially if the vulnerability is combined with the related issue CVE-2025-20333. No public evidence of ransomware campaigns leveraging this CVE has been documented.

Am I affected? How to find it in your systems

Cisco ASA and FTD appliances are typically deployed as firewalls, VPN concentrators, or threat-defense gateways at internet edges, data-center perimeters, or remote-access hubs. Inventory every device running ASA or FTD software that has the VPN web server (AnyConnect or clientless SSL VPN) enabled and reachable from untrusted networks.

• Query configuration management databases, network discovery tools, or Cisco management platforms (for example, FMC or ASDM) for all ASA and FTD instances.
• Confirm software versions and feature sets against the fixed releases listed in Cisco’s security advisory; do not rely on version ranges published elsewhere.
• Check whether the VPN web server is listening on external interfaces and whether any access-control lists or interface ACLs restrict source addresses.
• Review logs for anomalous HTTP/HTTPS requests to the VPN portal, unexpected authentication failures, or configuration changes that lack corresponding administrative sessions. Correlate with any alerts related to CVE-2025-20333 if that vulnerability is also present.

If the device is managed as a cloud service, also follow the applicable BOD 22-01 guidance referenced by CISA.

How to remediate

Apply the software update that Cisco has released for this vulnerability. Obtain the exact image names and upgrade paths from the official Cisco advisory and follow the vendor’s installation and verification procedures. After patching, re-validate that the VPN web server is running the corrected code and that authorization checks are functioning as expected.

• Prioritize internet-facing appliances that terminate remote-access VPN sessions.
• Where possible, schedule upgrades during maintenance windows that allow full regression testing of VPN connectivity and firewall policy.
• Document the change and retain pre- and post-upgrade configuration snapshots for audit purposes.

Once the patch is applied, re-enable any temporary compensating controls only if they remain necessary for defense-in-depth.

If you can't patch immediately

Until the vendor update can be installed, reduce the attack surface and increase detection.

• Restrict access to the VPN web server with interface ACLs or firewall rules so that only known, trusted source networks can reach the portal.
• If the VPN web server is not required, disable the feature entirely until a patched release is available.
• Place a web application firewall or reverse-proxy layer in front of the portal and apply virtual-patching rules that block anomalous request patterns; confirm rule efficacy against Cisco’s guidance.
• Segment management interfaces onto a dedicated, tightly controlled network and enforce multi-factor authentication for all administrative access.
• Heighten monitoring: forward ASA/FTD syslogs and VPN session logs to a SIEM, alert on unusual HTTP methods or high rates of failed authorization attempts, and watch for signs of chaining with CVE-2025-20333.

Federal civilian executive branch agencies must also follow the mitigation steps and timelines set out in CISA Emergency Directive 25-03 and the related KEV guidance.

If your data may have been exposed

Actively exploited edge vulnerabilities can lead to unauthorized access and subsequent data exposure. If you suspect compromise, isolate the affected appliance, preserve forensic logs, rotate credentials that may have been accessible through the VPN portal, and engage your incident-response process. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to determine whether any of your credentials have already appeared in public dumps.