Cisco Adaptive Security Appliance (ASA) Software - Authentication Bypass (CVE-2025-20362)

CVE-2025-20362 is a vulnerability in the VPN web server of Cisco ASA and Firepower Threat Defense Software that allows unauthenticated, remote attackers to access restricted VPN-related URL endpoints. By exploiting improper validation of user input in HTTP(S) requests, attackers can bypass authentication controls and gain unauthorized access to sensitive resources, potentially exposing confidential information or enabling further attacks.

CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-20362 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-20362 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-20362 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by sending crafted requests to URLs containing /+CSCOU+//../+CSCOE+/files/file_action.html, targeting restricted VPN web server endpoints on Cisco ASA and FTD devices to bypass authentication.