CVE-2025-20362: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

CVE-2025-20362 is a missing authorization vulnerability (CWE-862) in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that allows unauthenticated, remote attackers to access restricted URL endpoints related to remote access VPN. Disclosed on September 25, 2025, it affects multiple ASA software releases (9.12–9.23) and FTD software releases (7.0–7.7). It carries a CVSS v3.1 base score of 6.5 (Medium) per the official Cisco advisory, though Feedly's aggregated data reflects a higher score of 8.6 due to chaining with CVE-2025-20333 and the November 2025 DoS variant (Cisco Advisory, CISA KEV).

The vulnerability stems from improper validation of user-supplied input in HTTP(S) requests to the VPN web server component (CWE-862: Missing Authorization). An unauthenticated attacker can send specially crafted HTTP requests to the targeted device's web server to access restricted URL endpoints that should require authentication — specifically those related to remote access VPN services. The vulnerability is exploitable when any of the following configurations are active: AnyConnect IKEv2 Remote Access with client services (crypto ikev2 enable client-services port), Mobile User Security (MUS), or SSL VPN (webvpn enable). CVE-2025-20362 is designed to be chained with CVE-2025-20333 (a critical RCE vulnerability, CVSS 9.9) to achieve full device compromise. On November 5, 2025, Cisco identified a new attack variant that causes unpatched devices to unexpectedly reload, resulting in DoS conditions (Cisco Advisory, Cisco Event Response).

Successful exploitation allows an unauthenticated remote attacker to access restricted VPN web server endpoints without authentication, enabling information disclosure (confidentiality impact: low) and limited data manipulation (integrity impact: low). When chained with CVE-2025-20333, attackers can achieve full remote code execution and complete device compromise, enabling malware implantation, command execution, and data exfiltration. The November 2025 attack variant additionally causes unpatched devices to unexpectedly reload, creating denial-of-service conditions. Threat actor UAT-4356 (ArcaneDoor) leveraged these vulnerabilities to deploy malware families including RayInitiator, LINE VIPER, and the persistent FIRESTARTER backdoor — which survives reboots and software upgrades on older ASA 5500-X hardware lacking Secure Boot — against government and critical infrastructure targets globally (Cisco Event Response, CISA KEV).

CVE-2025-20362 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 25, 2025, with a due date of September 26, 2025 for federal agencies (CISA KEV). CISA issued Emergency Directive ED 25-03 requiring federal agencies to remediate. The vulnerability has been attributed to the state-sponsored threat actor UAT-4356 (also tracked as ArcaneDoor and Storm-1849, assessed with high confidence to be China-linked), which chained CVE-2025-20362 with CVE-2025-20333 to deploy FIRESTARTER, RayInitiator, and LINE VIPER malware. A public proof-of-concept scanner (CVE-2025-20362-Cisco-Scanner) was published on GitHub in May 2026, and Nuclei templates were also released. The EPSS score is approximately 0.81%. Shadowserver reported nearly 50,000 Cisco firewall devices remained vulnerable as of late September 2025, and in April 2026, CISA confirmed a U.S. federal agency's Cisco Firepower device was infected with the FIRESTARTER backdoor that persisted even after patching (Cisco Event Response, Cisco Talos, CISA Analysis).

1. Reconnaissance: Identify internet-facing Cisco ASA or FTD devices with VPN web services enabled using tools like Shodan, Censys, or the public CVE-2025-20362-Cisco-Scanner. Target devices running vulnerable ASA (9.12–9.23 pre-fix) or FTD (7.0–7.7 pre-fix) software.
2. Confirm VPN web services: Verify that the target has SSL VPN (webvpn enable), AnyConnect IKEv2 client services, or MUS enabled — these activate the vulnerable SSL listen sockets.
3. Exploit CVE-2025-20362 (authentication bypass): Send crafted HTTP(S) requests to the VPN web server to access restricted URL endpoints without authentication. This bypasses the authorization check due to improper input validation.
4. Chain with CVE-2025-20333 (RCE): Use the unauthorized access gained in step 3 to reach endpoints vulnerable to CVE-2025-20333, a critical memory corruption/RCE vulnerability in the same VPN web server component, to achieve unauthenticated remote code execution.
5. Establish persistence: Deploy malware such as FIRESTARTER (a Linux backdoor) to the device. On older ASA 5500-X hardware without Secure Boot (5512-X, 5515-X, 5525-X, 5545-X, 5555-X), modify ROMMON to survive reboots and software upgrades.
6. Evade detection: Disable logging, intercept CLI commands, and intentionally crash devices to prevent forensic analysis, as observed in confirmed ArcaneDoor intrusions.
7. Exfiltrate and pivot: Execute commands, exfiltrate data, and use the compromised firewall as a pivot point for lateral movement into protected network segments (Cisco Event Response, Cisco Talos).

• Network: Unusual or crafted HTTP(S) requests to VPN web server endpoints on ASA/FTD devices; unexpected outbound connections from firewall devices to unknown external IPs; scanning activity targeting Cisco ASA SSL VPN interfaces.
• Logs: Disabled or cleared logging on ASA/FTD devices; missing or truncated syslog entries around the time of suspected compromise; authentication events for VPN endpoints without corresponding valid user sessions.
• File System: Presence of firmware_update.log on disk0: after upgrading to a fixed release (indicates ROMMON persistence mechanism was detected and removed); unexpected files in device storage; FIRESTARTER backdoor artifacts in FXOS base OS.
• Process/Device Behavior: Unexpected device reloads or crashes (DoS variant); intercepted or modified CLI command output; devices failing to respond to diagnostic commands; ROMMON modifications on ASA 5500-X Series devices lacking Secure Boot (5512-X, 5515-X, 5525-X, 5545-X, 5555-X).
• Malware Families: Presence of RayInitiator, LINE VIPER, or FIRESTARTER malware artifacts on compromised devices.
• Snort Rules: Snort rule 46897 for CVE-2025-20362; Snort rule 65340 for CVE-2025-20333 (Cisco Event Response, CISA Analysis).

Upgrade (recommended): Apply fixed software releases immediately. For Cisco ASA Software: 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19. For Cisco FTD Software: 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1. Temporary mitigation: Disable all SSL/TLS-based VPN web services by running no webvpn (ASA) or removing Remote Access VPN policies (FTD via FMC/FDM); disable IKEv2 client services. Post-compromise recovery: For ASA 5500-X devices without Secure Boot, booting a fixed release will automatically detect and remove the ROMMON persistence mechanism and write firmware_update.log to disk0:. After upgrading, reset devices to factory defaults and reconfigure with new passwords, regenerated certificates, and keys. There are no workarounds that fully address the vulnerability — upgrade is the only permanent solution (Cisco Advisory, Cisco Event Response).

Cisco issued Emergency Directive ED 25-03 through CISA requiring federal agencies to remediate within one day of disclosure, reflecting the severity of active exploitation. CISA updated the directive in November 2025 after discovering federal agencies had not fully patched, and again in April 2026 after confirming a U.S. federal agency's Cisco Firepower device was infected with the persistent FIRESTARTER backdoor. The UK NCSC, Australian Signals Directorate, Canadian Centre for Cyber Security, and CISA jointly warned of the attacks and urged organizations to patch immediately. Tenable, Rapid7, Zscaler, and other security vendors published detailed FAQs and technical analyses. The Register, BleepingComputer, and CyberScoop provided extensive coverage. A U.S. Senator (Bill Cassidy) formally questioned Cisco about the business impact of the vulnerabilities in October 2025. The security community expressed significant concern on social media about the nearly 50,000 exposed devices identified by Shadowserver and the sophistication of the FIRESTARTER persistence mechanism that survived patching (Cisco Event Response, CISA Analysis, Cisco Talos).