Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 86.9%; technical severity is CVSS 8.6.
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
Who should care
- Teams operating Adaptive Security Appliance Software, Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense, Secure Firewall Threat Defense
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Adaptive Security Appliance Software, Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense, Secure Firewall Threat Defense is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Cisco Security advisory Cisco Sa Asaftd Webvpn YROOTUW
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Advisory
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- CWE
- CWE-862
- Affected versions
- Cisco Adaptive Security Appliance Software (Start Including 9.12, End Excluding 9.12.4.72 | Start Including 9.14, End Excluding 9.14.4.28 | Start Including 9.16, End Excluding 9.16.4.85 | Start Including 9.17.0, End Excluding 9.18.4.67); Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense; Cisco Secure Firewall Threat Defense (Start Including 7.0.0, End Excluding 7.0.8.1 | Start Including 7.1.0, End Excluding 7.2.10.2 | Start Including 7.3.0, End Excluding 7.4.2.4 | Start Including 7.6.0, End Excluding 7.6.2.1)
- Fixed versions
- Cisco Adaptive Security Appliance Software (Fixed from 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19); Cisco Secure Firewall Threat Defense (Fixed from 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1)
- Published
- 25 September 2025
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 86.9%
- Signal calculated at 82