Cisco patched two zero-days in ASA and FTD, CVE-2025-20333, CVE-2025-20362, that were exploited by the same threat actor behind the ArcaneDoor campaign, UAT4356

CVE-2025-20333, CVE-2025-20362: Cisco Zero-Days Exploited | Tenable®

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

Cisco Firepower devices continue to be targeted using exploiting known (n-day) vulnerabilities to deploy the FIRESTARTER backdoor. Apply available patches as soon as possible.

UAT-4356 continues to target Cisco Firepower devices, exploiting known (n-day) vulnerabilities to deploy the FIRESTARTER backdoor. Apply available patches as soon as possible.

CISA has released updated patch guidance and urges immediate patching for these Cisco vulnerabilities which have been exploited in the wild.

Exploitation has been observed in the wild. Patch as soon as possible.

Nearly 50k Cisco ASA/FTD devices remain vulnerable to two zero-day flaws exploited in the wild to deploy LINE VIPER and RayInitiator malware. Patch as soon as possible.

Zero-day vulnerability in Cisco ASA and FTD that was exploited in the wild by the same threat actor behind the ArcaneDoor campaign. Patch as soon as possible.

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions.
Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software [#fs] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability.

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software     and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to     access restricted URL endpoints without authentication that should otherwise be inaccessible without     authentication.  This vulnerability is due to improper validation of user-supplied input in HTTP(S)     requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web     server on a device. A successful exploit could allow the attacker to access a restricted URL without     authentication. (CVE-2025-20362)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a vulnerability.

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software     and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to     access restricted URL endpoints without authentication that should otherwise be inaccessible without     authentication.  This vulnerability is due to improper validation of user-supplied input in HTTP(S)     requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web     server on a device. A successful exploit could allow the attacker to access a restricted URL without     authentication. (CVE-2025-20362)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

ID	Name	Product	Family	Type	Severity
506196	Cisco ASA Missing Authorization (CVE-2025-20362)	Tenable OT Security	Tenable.ot	Remote	high
265966	Cisco Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access (cisco-sa-asaftd-webvpn-YROOTUW)	Nessus	CISCO	Local	medium
265965	Cisco Secure Firewall Adaptive Security Appliance Software VPN Web Server Unauthorized Access (cisco-sa-asaftd-webvpn-YROOTUW)	Nessus	CISCO	Local	medium

Detections

Analytics

CVE-2025-20362

high

Tenable Plugins

high

medium

medium