Detections
Analytics

Cisco ASA Missing Authorization (CVE-2025-20362)

high Tenable OT Security Plugin ID 506196

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions.
Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software [#fs] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

See Also

http://www.nessus.org/u?1d638962

http://www.nessus.org/u?3c68d455

http://www.nessus.org/u?c26d1723

Plugin Details

Severity: High

ID: 506196

File Name: tenable_ot_cisco_CVE-2025-20362.nasl

Version: 1.2

Type: Remote

Family: Tenable.ot

Published: 10/6/2026

Updated: 10/6/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: High

Score: 8.4

Percentile: 99.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C

CVSS Score Source: CVE-2025-20362

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:adaptive_security_appliance_software:9

Required KB Items: Tenable.ot/Cisco

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/25/2025

Vulnerability Publication Date: 9/25/2025

CISA Known Exploited Vulnerability Due Dates: 9/26/2025

Reference Information

CVE: CVE-2025-20362

CWE: 862