# CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

- Exploited (CISA KEV): yes, added 2025-09-25
- Published: 2025-09-25
- CVSS: 6.5 MEDIUM (v3.1)
- EPSS: 87.1% (100th percentile)
- CWE: CWE-862

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory.

 A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.

 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-09-28 | 3 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-12-03 | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-09-28 · new · rule a1bef4ada0b146d2862cad439ee0ab84 · default Disabled
  > Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363. Previous action: N/A. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-09-28-emergency-waf-release/
- 2025-09-28 · new · rule 51de6ce6596a40eb8200452ad30f768e · default Disabled
  > Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363. Previous action: N/A. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-09-28-emergency-waf-release/
- 2025-10-07 · new · rule 12f808a5315441688f3b7c8a3a4d1bd6 · default Block
  > Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363. Previous action: N/A. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-10-07-emergency-waf-release/

### F5

- 2025-12-03 · updated · rule 200013049
  > Updated: signature 200013049 "Cisco ASA authorization bypass" (Authentication/Authorization Attacks, risk High), systems: Cisco. References: CVE-2025-20362, CVE-2018-0296.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2025-20362, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2025-20362, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-20362 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-20362