Cisco Secure Firewall ASA and FTD Missing Authorization (CVE-2025-20362)

Historical catalog analysis: CISA added this entry on September 25, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-20362 is a missing authorization vulnerability (CWE-862) affecting the VPN Web Servers of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. This flaw allows for unauthorized access to specific functions due to a failure in the system’s authorization checks. Notably, this vulnerability can be chained with CVE-2025-20333, potentially increasing the overall impact on the affected device.

Exposure and applicability

This vulnerability applies specifically to organizations deploying Cisco ASA or FTD devices where the VPN Web Server functionality is enabled and exposed. Because these devices often sit at the network edge to facilitate remote access, they are high-priority targets for exposure management. The risk is heightened for environments that have not yet addressed CVE-2025-20333, as the two vulnerabilities can be used in tandem.

Potential breach-prevention strategy

CISA’s inclusion of this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog indicates that actual exploitation has occurred. The reported entry path is via the VPN Web Server due to missing authorization; however, the full sequence of an actual attack remains unknown.

Our analysis suggests a similar breach could have been mitigated through the following prioritized actions:

1. Attack Surface Reduction: If the VPN Web Server functionality is not required for business operations, disabling it would prevent initial access via this path. (Responsible: Network Security Engineer; Verification: Port scan/service check to confirm the web server is unreachable).
2. Rapid Patch Deployment: Applying vendor-provided updates specifically for CVE-2025-20362 and CVE-2025-20333 could have reduced the likelihood of successful chaining. (Responsible: Vulnerability Management Team; Verification: Version check against vendor’s fixed release list).
3. Post-Compromise Eviction: Because patching does not remove an existing adversary, implementing CISA’s eviction strategies and core dump analysis is necessary to limit damage after a potential breach. (Responsible: Incident Response Lead; Verification: Analysis of system memory/logs for unauthorized persistence indicators).

These actions are categorized as either preventing initial access (disabling services, patching) or limiting damage and improving recovery (eviction strategies). These measures could have reduced the likelihood of compromise but do not guarantee prevention. Residual risk remains if attackers established persistence via other vulnerabilities prior to these controls being applied.

Remediation priorities

Based on our analysis of the vulnerability and its inclusion in CISA’s KEV catalog, we recommend the following priority sequence:

1. Asset Identification: Immediately identify all ASA and FTD instances with active VPN Web Server configurations.
2. Vendor Mitigation Application: Apply the specific updates or workarounds provided in the Cisco Security Advisory for this vulnerability to address the missing authorization flaw.
3. Chain-Risk Reduction: Prioritize the remediation of CVE-2025-20333 on any device where CVE-2025-20362 is present, as the source indicates these can be chained.
4. Compromise Assessment: Following mitigation, execute a hunt for indicators of compromise using CISA’s provided core dump and eviction strategies to ensure the vulnerability was not exploited prior to patching.

How to validate remediation

Verification must move beyond simple version checks. To assure that exposure has been reduced, defenders should:

• Configuration Audit: Confirm that the specific software versions or configuration changes recommended by Cisco are active across all identified edge devices.
• Authorization Testing: In a controlled environment, verify that the previously unauthorized paths to the VPN Web Server functions now return appropriate authorization errors (e.g., 403 Forbidden) rather than granting access.
• Log Analysis: Review system logs for patterns consistent with the missing authorization flaw to determine if remediation occurred before or after attempted exploitation.

Limits and open questions

Applying a patch or mitigation reduces the likelihood of future exploitation but does not remove an existing adversary who may have already gained access. There is a residual risk that attackers have established persistence through other means during the window of exposure. Additionally, while CISA has flagged this as known to be exploited, the specific nature of current ransomware campaign usage remains unknown according to available data.

Source and editorial note

CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability · Source date: September 25, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: September 28, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 02, 2026 at 00:31 UTC.

Request a Vulnerability Assessment