CVE-2025-20362

ENISA EUVD: EUVD-2025-31139 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 5, 2026 8 articles Published: 2025-09-25
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23
46.78%
probability
This CVE has a 46.78% probability of being exploited in the next 30 days.
0% Top 97.7th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
6.5
MEDIUM
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

VulnerabilityLookup (CNA)
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

Affected Products

Cisco
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
9.8.1 9.8.1.5 9.8.1.7 9.8.2 9.8.2.8 9.8.2.14
Cisco
Cisco Secure Firewall Threat Defense (FTD) Software
6.2.3 6.2.3.1 6.2.3.2 6.2.3.3 6.2.3.4 6.2.3.5

Attack Intelligence

Exploits & PoC

curtishoughton/CVE-2025-20362-Cisco-Scanner

Safe Python scanner for CVE-2025-20362 (Cisco ASA/FTD WebVPN Authentication Bypass)

0 2026-05-16
1 repo — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidenceⓘ
85%
EPSS 46.78%
CVSS v3.1 6.5
Mentions 8
Last Seen Apr 23, 2026

CNA Information

CNA Assigner
cisco

Analyst Note

CVE-2025-20362 is explicitly named in multiple sources (BleepingComputer, CERT-EU, TheHackerNews) as being exploited in zero-day attacks against Cisco ASA/FTD devices. Cisco's November 5, 2025 advisory confirms active exploitation of unpatched devices occurred before patch availability. The CVE publication date (September 25, 2025) and subsequent exploitation disclosure support zero-day classification.

Threat Actors 20

APT 29
apt_group Information theft and espionage 🇷🇺 RU
APT 28
apt_group Information theft and espionage 🇷🇺 RU
CHRYSENE
apt_group Information theft and espionage 🇮🇷 IR
Hacking Team
apt_group 🇮🇹 IT
Cleaver
apt_group Information theft and espionage 🇮🇷 IR
Tick
apt_group Information theft and espionage 🇨🇳 CN
HAZY TIGER
apt_group Information theft and espionage 🇮🇳 IN
Volt Typhoon
apt_group Information theft and espionage 🇨🇳 CN
Group 27
apt_group Information theft and espionage 🇨🇳 CN
GCHQ
apt_group Information theft and espionage 🇬🇧 GB
ArcaneDoor
apt_group 🇨🇳 CN
APT 22
apt_group Information theft and espionage 🇨🇳 CN
APT 6
apt_group Information theft and espionage 🇨🇳 CN
Red October
apt_group 🇷🇺 RU
The White Company
apt_group Information theft and espionage 🇨🇳 CN
Pat Bear
apt_group 🇸🇾 SY
Shadow Network
apt_group Information theft and espionage 🇨🇳 CN
Mana Team
apt_group 🇨🇳 CN
APT 5
apt_group Information theft and espionage 🇨🇳 CN
Beijing Group
apt_group Information theft and espionage 🇨🇳 CN

Triage Info

Decided atMar 05, 2026
Published DateSep 25, 2025