A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

Zero-day vulnerability in Cisco ASA and FTD that was exploited in the wild by the same threat actor behind the ArcaneDoor campaign. Patch as soon as possible.

IOS XR cisco-sa-http-code-exec-WmfP3h3O

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability.

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software     and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to     access restricted URL endpoints without authentication that should otherwise be inaccessible without     authentication.  This vulnerability is due to improper validation of user-supplied input in HTTP(S)     requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web     server on a device. A successful exploit could allow the attacker to access a restricted URL without     authentication. (CVE-2025-20362)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a vulnerability.

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software     and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to     access restricted URL endpoints without authentication that should otherwise be inaccessible without     authentication.  This vulnerability is due to improper validation of user-supplied input in HTTP(S)     requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web     server on a device. A successful exploit could allow the attacker to access a restricted URL without     authentication. (CVE-2025-20362)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

ID	Name	Product	Family	Severity
265966	Cisco Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access (cisco-sa-asaftd-webvpn-YROOTUW)	Nessus	CISCO	medium
265965	Cisco Secure Firewall Adaptive Security Appliance Software VPN Web Server Unauthorized Access (cisco-sa-asaftd-webvpn-YROOTUW)	Nessus	CISCO	medium

Detections

Analytics

CVE-2025-20362

medium

Tenable Plugins

Coming Soon

medium

medium