Authentication bypass in Cisco ASA and FTD VPN web server

Successful standalone exploitation permits unauthenticated access to restricted VPN-related endpoints. Reported exploitation can expose tokens, cookies, or session metadata that attackers may reuse to obtain authenticated VPN access. Chaining with CVE-2025-20333 can enable arbitrary code execution with administrator privileges and full appliance compromise; this is not a demonstrated standalone capability of CVE-2025-20362. An attack variant targeting devices affected by both vulnerabilities causes repeated reloads and denial of service. Malware deployed following compromise can preserve access after software upgrades.

If upgrading is not immediately possible, disable all SSL/TLS-based VPN web services as described in Cisco's mitigation guidance. Restrict VPN portal and management access using access controls, disable unnecessary services, and isolate management networks. Enable Threat Detection for VPN Services and forward logs to external repositories. These measures reduce exposure or support detection but do not replace upgrading or remediation of an existing compromise.

Upgrade affected ASA and FTD installations to the applicable Cisco fixed software release, using Cisco's advisory and Software Checker to identify the appropriate release for each software branch. Investigate exposed devices for compromise and preserve relevant forensic evidence. Patching does not necessarily remove previously installed implants such as FIRESTARTER. Confirmed compromise requires campaign-specific vendor and incident-response procedures, potentially including appliance rebuilding or replacement. Reset associated passwords, certificates, and keys after securing affected devices.