Cisco Zero-Day CVE-2025-20362 Under Attack: VPN Flaw in ASA/FTD Exposes Restricted Resources

Cisco has released software updates addressing a zero-day vulnerability in the VPN web server of its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software, tracked as CVE-2025-20362 and rated CVSS 6.5 (Medium-High). The flaw could allow unauthenticated attackers to access restricted resources by exploiting improper validation of user-supplied input in HTTP(S) requests, with a successful exploit enabling access to restricted URL endpoints without authentication.

The vulnerability affects ASA software when configured with AnyConnect IKEv2 Remote Access, Mobile User Security (MUS), or SSL VPN, and FTD software when configured with AnyConnect IKEv2 Remote Access or AnyConnect SSL VPN, with Cisco noting that remote access VPN features can create exploitable SSL listen sockets. The Cisco Product Security Incident Response Team (PSIRT) confirmed that the flaw has already been targeted.

Cisco strongly advises upgrading to a fixed software release and, after installation, reviewing the Configure Threat Detection for VPN Services section of the Cisco Secure Firewall ASA Firewall CLI Configuration Guide for enhanced protections. The article underscores that the issue was publicly disclosed by Cisco and that updates are available to remediate the vulnerability.