Threat Intelligence / CVE / CVE-2025-20362

CVE-2025-20362

CVSS 8.6 (HIGH) · EPSS 50.7% · Published 2025-09-25

A vulnerability in the VPN web server of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to access restricted URL endpoints through improper HTTP input validation.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weaknesses (CWE)

CWE-862

Threats tracking this CVE

Firestarter Malware Persists on Cisco ASA/Firepower Through Firmware Updates (CVE-2025-20333, CVE-2025-20362) — UAT-4356/ArcaneDoor — CRITICAL

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362

Full detection coverage & IOCs for threats exploiting CVE-2025-20362 are available via the Threadlinqs MCP server (Purple tier). View plans →

Markdown version · Threadlinqs Intelligence