PT-2025-39421 · Cisco · Cisco Secure Firewall Threat Defense+2

Published

2025-09-25

·

Updated

2026-05-11

·

CVE-2025-20362

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) (affected versions not specified) Cisco Firepower Threat Defense (FTD) (affected versions not specified)
Description A missing authorization issue in the VPN web server of Cisco ASA and FTD allows an unauthenticated remote attacker to bypass security mechanisms and access protected URLs. This is achieved by sending specially crafted HTTP requests, which can impact the confidentiality and integrity of protected information. Real-world exploitation of this issue has been observed.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-11751
CVE-2025-20362

Affected Products

Cisco Asa
Cisco Secure Firewall Asa
Cisco Secure Firewall Threat Defense