Skip to content
Fencer Vulns
medium 6.5

CVE-2025-20362 kev in the critical feed json

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure F…

published 2025-09-25 13 mo ago modified 2026-10-18 21 d ago also EUVD-2025-31139

cvss
6.5
version 3.1, CNA
cisa kev
Exploited
added 2025-09-25
epss
86.7%
EPSS 86.7% chance of exploitation in 30 days, percentile 99.7%
public exploits
0
none known, plus a Nuclei check

Summary

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

Patch / fix

cisa required action The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

  • cisco adaptive_security_appliance_software 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19
  • cisco asa 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19
  • cisco firepower_threat_defense 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1
  • cisco ftd 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1

Timeline

  1. Added to CISA KEV
  2. Published
  3. CISA patch deadline
  4. CISA SSVC: exploitation active

Known exploited

Added
13 mo ago
Patch by
2025-09-26 (13 mo ago)
Ransomware
Not known
Required action
The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Vendor, product
Cisco, Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
CISA name
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
partial
Assessed
13 mo ago

Exploit prediction

86.69% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Cisco Secure Firewall ASA & FTD - Authentication Bypass nuclei detection template

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

  • Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
  • Cisco Cisco Secure Firewall Threat Defense (FTD) Software

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.