Cisco ASA/FTD CVE-2025-20362

The VPN web server (WebVPN or RA-VPN portal) must be enabled and reachable from the attacker's network - this feature is enabled when remote-access VPN is configured on an interface. No authentication is required (PR:N confirmed by CVSS vector). No user interaction is needed. The attack is fully remote and low-complexity, requiring only the ability to send HTTP(S) requests to the appliance's management or outside interface on the VPN listener port (typically 443). The primary factor limiting exploitation is network exposure: appliances that do not expose their WebVPN listener to untrusted networks (e.g., firewalls with VPN listener restricted to corporate WAN only) are harder to reach opportunistically, but still vulnerable to any attacker who can route to that interface. The DoS reload variant additionally requires that the device also be unpatched against CVE-2025-20333; exploiting either CVE alone triggers the defined impacts, while exploiting both in combination produces the reload behavior.

This vulnerability carries high real-world priority across every signal available. The CVSS 8.6 base score reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-user-interaction (UI:N) attack path with High availability impact and Low confidentiality and integrity impact - a combination that matches the confirmed exploit behavior. EPSS at 43.64% and the 97th percentile independently confirms that this class of vulnerability is being actively exploited broadly, not just in targeted scenarios. CISA's KEV listing confirms active exploitation in the wild, removing any ambiguity about whether this is a theoretical risk. A public proof-of-concept is available, meaning the barrier to exploitation is minimal; even a mid-sized municipal IT team in olsztyn managing a handful of ASA appliances for remote-access VPN should treat this as urgent rather than routine patch-cycle work. The availability impact is particularly significant given the November 2025 disclosure that unpatched devices can be forced into unexpected reloads via a combined attack with CVE-2025-20333, transforming an information disclosure/authorization bypass into a denial-of-service weapon against critical network infrastructure. No signals conflict: all sources (CVSS, EPSS, KEV, POC, updated advisory) align on high urgency.

An attacker with network access to a Cisco ASA or FTD appliance's VPN web server port (typically TCP 443) sends a crafted HTTP or HTTPS request targeting a restricted RA-VPN URL endpoint - no credentials or session token required. The missing authorization check allows the request to be processed, granting the attacker access to restricted VPN portal functionality or internal endpoints. In the extended attack variant combining this CVE with CVE-2025-20333, the crafted requests can force the device to reload unexpectedly, denying VPN and firewall services to all users and potentially disrupting network connectivity for the organization. A public proof-of-concept is available, lowering the skill threshold for exploitation.