CVE-2025-20362 is a (ASA) (FTD) missing authorization vulnerability in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 September 2025, which means attackers have used it in real attacks. This vulnerability could be chained with CVE-2025-20333.
What this vulnerability means in practice
A missing authorization flaw in a firewall platform is dangerous because perimeter devices often sit at high-trust choke points. If an attacker can reach the affected interface or service, they may be able to perform actions the device should have reserved for authenticated, authorised administrators or trusted components.
For Cisco Secure Firewall ASA and FTD, the practical concern is not just unauthorized access to one feature, but the possibility of using the device as a stepping stone into a broader network. That is why CISA’s KEV listing matters: it indicates confirmed real-world exploitation, so organisations should treat exposure as operationally urgent rather than purely theoretical. See the CISA cyber threat advisories catalogue for authoritative KEV context.
Why this class of flaw is high impact on security appliances
Authorization failures on security appliances can be more consequential than the same bug in a low-trust application because the appliance often brokers traffic, enforces policy, and stores sensitive configuration. A bypass can expose management actions, security policy state, logs, tunnels, or trust relationships that were assumed to be protected.
The major risk is privilege transposition: an attacker does not need to “break” the firewall in the traditional sense if they can abuse a logic gap that skips the authorization decision. On a device that protects other systems, that can quickly turn into reconnaissance, policy tampering, or access to adjacent administrative planes.
This is also why firewall flaws are frequently chained with other vulnerabilities. In this case, the primary definition notes chaining with CVE-2025-20333, which is a reminder that one weakness can become the first step in a larger intrusion path.
How organisations should assess exposure
Start with asset inventory, because exposure depends on whether Cisco Secure Firewall ASA or FTD is present, where it is deployed, and whether the vulnerable interface is reachable from untrusted networks. Internet-facing management planes, exposed VPN entry points, and externally reachable appliance services deserve immediate review.
Then check vendor advisories and your vulnerability management records rather than assuming that all appliances are equally affected. For a public vulnerability like this, the most reliable triage path is to confirm exact product presence, confirm exposure path, and compare it with the vendor’s guidance and the KEV catalogue. The NIST National Vulnerability Database and the CVE Program are the canonical references for record tracking and vulnerability identification.
Remediation, detection, and post-exploitation review
When patching or upgrade timing is constrained, compensating controls should focus on reducing reachable attack surface and limiting what the appliance can do if abused. That usually means tightening management exposure, restricting administrative access paths, reviewing adjacent trust relationships, and validating whether any temporary workaround still leaves the vulnerable function reachable.
Detection should not stop at “was it patched.” Organisations should review device logs, authentication records, configuration changes, tunnel or policy changes, and any unexpected administrative activity around the exploitation window. Because firewall appliances mediate privileged traffic, successful exploitation can create secondary evidence in adjacent systems, not just on the device itself.
After remediation, treat the device as a possible source of deeper compromise and review whether credentials, sessions, certificates, API tokens, or other privileged secrets handled by the appliance need rotation. The practical question is whether the attacker gained a path to persistence or lateral movement before the flaw was closed.
Risk and Threat Considerations
This vulnerability is risky because a missing authorization check on a boundary device can collapse the trust model that keeps untrusted users away from sensitive administrative or policy functions. If the affected path is internet reachable, exploitation can happen quickly and with little warning.
Failure mechanism: An attacker abuses a request path that skips or weakens the expected authorization decision, then uses the appliance’s trusted position to reach configuration, policy, or adjacent network functions that should have been gated.
Impact: The result can include unauthorized control of the firewall, exposure of sensitive configuration, broader network access, or a launch point for follow-on compromise across protected assets.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | Missing authorization directly concerns enforcing access decisions on protected functions. |
| IA-2 — Identification and Authentication (Organizational Users) | Administrative access on security appliances depends on strong identity verification before authorisation. | |
| Recommendation — Enforce AC-3 on appliance management paths and privileged functions. Require IA-2 controls for all administrative access to firewall management interfaces. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | The flaw can permit unauthorised access to sensitive device functions and management paths. |
| Recommendation — Use CIS-6 to restrict and review who can reach and operate firewall administration paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity and Access Management | The term concerns whether protected device actions are properly authorised. |
| Recommendation — Apply PR.AA-05 to validate authorization for privileged firewall operations. | ||
| MITRE ATT&CK | T1562.001 — Impair Defenses: Disable or Modify Tools | Compromised firewall control can be used to alter defensive functions and visibility. |
| Recommendation — Map suspicious firewall tampering to T1562.001 and hunt for defense impairment. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a perimeter integrity issue, not a routine software defect. On security appliances, one authorization flaw can undermine multiple downstream controls at once.
What to watch for: Look for unexpected administrative actions, configuration drift, unusual policy changes, and access patterns that do not match normal firewall operations. Those are often the earliest signs that a boundary device has been abused.
Practitioner takeaway: Prioritise exposure confirmation, vendor remediation guidance, and post-patch compromise review together, because patching alone does not prove the appliance was never used maliciously.
Related resources from NHI Mgmt Group
- CVE-2025-20333 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow)
- CVE-2026-20349 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection)
- CVE-2026-20131 (Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data)
- How should security teams test for missing authorization checks in Secure SDLC?