VulnRadar

Data against noise.

Built with NaN
Page generated: 10 Nov 2026, 16:38 UTC
← Dashboard

CVE-2025-20362

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, …

Read full description
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
CVSS 6.5 (MEDIUM) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.4/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 6.5: +0.97
  • Fresh EPSS: 86.69%: +0.43

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 29 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

SDxCentral
Press · 28 Apr 2026, 07:00 · Cisco firewalls at risk from Firestarter bug: CISA - SDxCentral
Cisco Talos Blog
Press · 23 Apr 2026, 07:00 · UAT-4356's Targeting of Cisco Firepower Devices - Cisco Talos Blog
The Record from Recorded Future News
Press · 23 Apr 2026, 07:00 · CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March - The Record from Recorded Future News
Help Net Security
Press · 13 Nov 2025, 08:00 · "Patched" but still exposed: US federal agencies must remediate Cisco flaws (again) - Help Net Security
Industrial Cyber
Press · 13 Nov 2025, 08:00 · CISA urges immediate patching of Cisco ASA and Firepower devices due to active zero-day exploits - Industrial Cyber
See all 29 source documents
BleepingComputer
Press · 13 Nov 2025, 08:00 · CISA warns feds to fully patch actively exploited Cisco flaws - BleepingComputer
Cybersecurity Dive
Press · 10 Nov 2025, 08:00 · Cisco detects new attack variant targeting vulnerable firewalls - Cybersecurity Dive
Rescana
Press · 09 Nov 2025, 08:00 · Cisco ASA and FTD Firewall Vulnerabilities: Active Exploitation of CVE-2025-20333 and CVE-2025-20362 Enables DoS Attacks and Full Device Compromise - Rescana
BleepingComputer
Press · 07 Nov 2025, 08:00 · Cisco: Actively exploited firewall flaws now abused for DoS attacks - BleepingComputer
The Hacker News
Press · 06 Nov 2025, 08:00 · Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362 - The Hacker News
The Record from Recorded Future News
Press · 31 Oct 2025, 07:00 · Chinese hackers scanning, exploiting Cisco ASA firewalls used by governments worldwide - The Record from Recorded Future News
Recorded Future
Press · 17 Oct 2025, 07:00 · September 2025 CVE Landscape - Recorded Future
Help Net Security
Press · 01 Oct 2025, 07:00 · Too many Cisco ASA firewalls still unsecure despite zero-day attack alerts - Help Net Security
Cybersecurity Dive
Press · 30 Sep 2025, 07:00 · Cisco firewall flaws endanger nearly 50,000 devices worldwide - Cybersecurity Dive
BleepingComputer
Press · 30 Sep 2025, 07:00 · Nearly 50,000 Cisco firewalls vulnerable to actively exploited flaws - BleepingComputer
Industrial Cyber
Press · 29 Sep 2025, 07:00 · CISA issues Emergency Directive requiring federal agencies to mitigate critical Cisco ASA zero-day vulnerabilities - Industrial Cyber
thestack.technology
Press · 26 Sep 2025, 07:00 · Cisco 0day exploitation: Scans suggested it’s coming - thestack.technology
CyberSecurityNews
Press · 26 Sep 2025, 07:00 · Cisco ASA 0-Day RCE Vulnerability Actively Exploited in the Wild - CyberSecurityNews
Help Net Security
Press · 26 Sep 2025, 07:00 · Cisco ASA zero-day vulnerabilities exploited in sophisticated attacks - Help Net Security
The Hacker News
Press · 26 Sep 2025, 07:00 · Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware - The Hacker News
Unit 42
Press · 26 Sep 2025, 07:00 · Threat Insights: Active Exploitation of Cisco ASA Zero Days - Unit 42
SecurityWeek
Press · 26 Sep 2025, 07:00 · Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks - SecurityWeek
BleepingComputer
Press · 25 Sep 2025, 07:00 · Cisco warns of ASA firewall zero-days exploited in attacks - BleepingComputer
Rapid7
Press · 25 Sep 2025, 07:00 · Multiple critical vulnerabilities affecting Cisco products | CVE-2025-20333, CVE-2025-20362, CVE-2025-20363 - Rapid7
CISA (.gov)
Press · 25 Sep 2025, 07:00 · ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices - CISA (.gov)
The Record from Recorded Future News
Press · 25 Sep 2025, 07:00 · Federal agencies given one day to patch exploited Cisco firewall bugs - The Record from Recorded Future News
The Hacker News
Press · 25 Sep 2025, 07:00 · Urgent: Cisco ASA Zero-Day Duo Under Attack; CISA Triggers Emergency Mitigation Directive - The Hacker News
GreyNoise
Press · 04 Sep 2025, 07:00 · 25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming - GreyNoise
Cisco Talos Blog
Press · 24 Apr 2024, 07:00 · ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices - Cisco Talos Blog

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.4 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 6.5; EPSS 86.7%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:29.589072+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
24 Apr 2024, 07:00
Added to the CISA KEV catalog
25 Sep 2025, 00:00
Published
25 Sep 2025, 16:12
Latest press mention
28 Apr 2026, 07:00
Score calculated
05 Nov 2026, 13:59
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar