CVE-2025-20362

A critical vulnerability has been identified in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. This issue arises from improper validation of user-supplied input in HTTP(S) requests, allowing unauthenticated remote attackers to access restricted URL endpoints related to remote access VPN functionalities. The flaw can be exploited by sending specially crafted HTTP requests to the targeted web server, enabling unauthorized access to sensitive resources that should otherwise require authentication. This vulnerability is particularly concerning as it can lead to significant security breaches if left unaddressed.

The attack vectors associated with this vulnerability are straightforward yet effective. An attacker can leverage the improper input validation to craft malicious HTTP requests, targeting the web server of an affected device. Once the crafted request is sent, the attacker may gain access to restricted URLs, potentially allowing them to execute further attacks or gather sensitive information. In addition, the vulnerability has been linked to a new attack variant that can cause unpatched devices to unexpectedly reload, resulting in denial of service (DoS) conditions. This dual threat amplifies the urgency for organizations to address the vulnerability promptly.

The real-world impact of this vulnerability can be severe, particularly for organizations that rely on Cisco's security appliances for their network defense. Unauthorized access to restricted VPN endpoints can lead to data breaches, unauthorized network access, and the potential for attackers to escalate their privileges within the network. Moreover, the resulting denial of service can disrupt business operations, leading to financial losses and damage to an organization’s reputation. The implications extend beyond immediate financial costs, as regulatory penalties may also be incurred if sensitive data is compromised.

To effectively detect and mitigate this vulnerability, organizations should prioritize upgrading to the fixed software releases provided by Cisco. Regularly updating software is a fundamental cybersecurity practice that can significantly reduce the risk of exploitation. Additionally, implementing robust network monitoring solutions can help detect unusual HTTP request patterns indicative of an attempted exploit. Organizations should also consider employing intrusion detection systems (IDS) that can analyze traffic for signs of malicious activity related to this vulnerability. Furthermore, conducting regular security assessments and penetration testing can help identify potential weaknesses and ensure that security measures are up to date.

In conclusion, the vulnerability in Cisco's VPN web server poses a substantial risk to organizations utilizing the affected software. The potential for unauthorized access and denial of service highlights the importance of proactive security measures. By prioritizing software updates, enhancing monitoring capabilities, and conducting thorough security assessments, organizations can significantly mitigate the risks associated with this vulnerability and protect their critical assets from exploitation.

CSURFACE threat intelligence has detected a marked escalation in attack activity targeting Cisco Secure ASA and FTD devices vulnerable to CVE-2025-20362. This increase in telemetry correlates with the emergence of a new attack variant capable of causing unpatched systems to unexpectedly reload, resulting in denial of service conditions. Despite the downward revision of the CVSS score from 8.6 to 6.5, the elevated EPSS score and rising detection trends indicate that exploitation attempts are becoming more frequent and widespread. This shift underscores a more active threat landscape where adversaries are increasingly leveraging this vulnerability to disrupt network security infrastructure. For defenders, the evolving exploitation patterns necessitate heightened vigilance and continuous monitoring, as the risk of operational impact through service interruptions has grown. While no new exploit techniques have been publicly disclosed, the observed surge in attack attempts signals that threat actors are refining their methods, potentially increasing the likelihood of successful intrusions or service disruptions. Consequently, the overall threat level remains significant, with a moderate severity rating that belies the practical impact observed in the field.

Update 2 — June 07, 2026

CSURFACE threat intelligence has identified a new development in the exploitation landscape of CVE-2025-20362, marked by the emergence of a publicly available proof-of-concept exploit hosted on GitHub. This represents a significant shift from previous conditions where no such exploit code was accessible, lowering the barrier for threat actors to conduct targeted attacks against vulnerable Cisco Secure ASA and FTD devices. Although telemetry indicates a significant reduction in detection activity overall, the availability of this exploit tool signals an expansion in the exploit toolkit that adversaries can leverage. Notably, the CVSS score for this vulnerability has been revised upward from 6.5 to 8.6, reflecting an increased potential for impactful denial-of-service conditions through unexpected device reloads. Despite a slight decrease in the EPSS score, the vulnerability remains in the upper percentile of exploit likelihood, underscoring persistent risk. For defenders, this evolution necessitates heightened vigilance, as the presence of public exploit code can accelerate attack attempts and reduce the window for effective mitigation. Consequently, the threat level associated with CVE-2025-20362 has escalated to high severity, emphasizing the critical need for timely patching and continuous monitoring to prevent operational disruptions.

Update 3 — July 05, 2026

CSURFACE threat intelligence has detected a notable surge in activity exploiting CVE-2025-20362, with telemetry indicating increased attempts to trigger denial-of-service conditions via unexpected device reloads on vulnerable Cisco Secure ASA and FTD Software deployments. This uptick in exploitation attempts coincides with the emergence of new proof-of-concept scanning tools publicly available, which likely lowers the barrier for adversaries to identify and target susceptible systems. Although the EPSS score shows a slight upward trend, the overall exploit likelihood remains high, reinforcing the urgency of this vulnerability as a persistent threat vector. For defenders, this evolution signals a narrowing window to detect and respond to exploitation attempts before operational disruptions occur, particularly given the continued presence of active scanning and probing campaigns. Consequently, the threat level associated with CVE-2025-20362 has intensified, underscoring the critical importance of sustained monitoring and rapid incident response capabilities.