Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FT
Affects Cisco Secure Firewall ASA and FTD software running certain remote access VPN configurations, such as AnyConnect IKEv2 with client services, Mobile User Security, or SSL VPN. Fixed in ASA 9.12.4.72 and 9.14.4.28.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 9.12.4.72, 9.14.4.28
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software are affected. A flaw in the VPN web server could allow an unauthenticated remote attacker to reach restricted remote access VPN URL endpoints, and a new attack variant can cause unpatched devices to unexpectedly reload, resulting in denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
Timeline
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CVE published
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
9.8.1, 9.8.1.5, 9.8.1.7, 9.8.2, 9.8.2.8, 9.8.2.14, 9.8.2.15, 9.8.2.17, 9.8.2.20, 9.8.2.24, 9.8.2.26, 9.8.2.28, 9.8.2.33, 9.8.2.35, 9.8.2.38, 9.8.3.8, 9.8.3.11, 9.8.3.14, 9.8.3.16, 9.8.3.18, 9.8.3.21, 9.8.3, 9.8.3.26, 9.8.3.29, 9.8.4, 9.8.4.3, 9.8.4.7, 9.8.4.8, 9.8.4.10, 9.8.4.12, and 205 more
- Cisco Cisco Secure Firewall Threat Defense (FTD) Software
6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5, 6.2.3.6, 6.2.3.7, 6.2.3.8, 6.2.3.10, 6.2.3.11, 6.2.3.9, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.15, 6.2.3.16, 6.2.3.17, 6.2.3.18, 6.6.0, 6.6.0.1, 6.6.1, 6.6.3, 6.6.4, 6.6.5, 6.6.5.1, 6.6.5.2, 6.6.7, 6.6.7.1, 6.6.7.2, and 70 more
References 1
sec.cloudapps.cisco.com
Questions about CVE-2025-20362
What does this mean?
An unauthenticated attacker can reach restricted remote access VPN URL endpoints that should be inaccessible without authentication.Source: sec.cloudapps.cisco.com
Am I affected, and how do I check?
Devices running a vulnerable release of Cisco Secure Firewall ASA or FTD Software with one of the listed remote access VPN configurations, such as AnyConnect IKEv2 with client services, Mobile User Security, or SSL VPN. Check the software version and VPN configuration against the two tables in the advisory.Source: sec.cloudapps.cisco.com
What should I do about it?
Move to a fixed release. The advisory names ASA Software 9.12.4.72 or 9.14.4.28 as the fixed versions.Source: sec.cloudapps.cisco.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-09-25, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data