Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause…
Gravité = CVSS. Probabilité = EPSS (FIRST). Exploitation = signaux publics : KEV, EUVD, rançongiciel, EPSS au-dessus de 10 %, accès sans compte.
Probabilité d’exploitation EPSS · FIRST
Signaux d’exploitation 4 / 5
- Catalogue KEV (CISA)25/09/2025
- EUVD exploitée (ENISA)25/09/2025
- Utilisée par des rançongicielsnon
- EPSS au-dessus de 10 %87,1 %
- Sans compte, par le réseauoui
Que faire
Corriger
Appliquer le correctif de l’éditeur dès qu’il est disponible.
Consigne de la CISA : The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
En attendant
Retirer le service d’internet ou en filtrer l’accès, surveiller les journaux et chercher des traces de compromission.
Éditeurs (CRA)
Faille exploitée dans votre produit : alerte précoce à l’ENISA sous 24 h, puis notification sous 72 h (article 14 du Cyber Resilience Act). Le CRA expliqué
Description ENISA EUVD
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
Texte de la source, en anglais.
Produits touchés
- 9.8.3.8
- 9.8.4.29
- 6.4.0.14
- 9.8.3.11
- 6.2.3.17
- 9.17.1.15
- 9.12.4.30
- 9.18.4.57
- 7.0.8
- 9.12.4.4
- 9.18.4.8
- 9.18.4.40
Paquets open source OSV
Bibliothèques touchées selon OSV, avec les versions corrigées.
Chronologie
-
Publication
-
Exploitation signalée (ENISA)
-
Ajout au catalogue KEV
-
Échéance de correction CISA
-
EPSS au plus haut : 87,1 %
Références
Autres failles exploitées du même éditeur
- CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability5,3 · Montée rapide
- CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal Vulnerability5,8 · Montée rapide
- CVE-2026-76504Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability7,5 · Exploitation active
- CVE-2026-76460Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability8,7 · Exploitation active
- CVE-2026-76461Cisco Secure Email Gateway SQL Injection Vulnerability7,2 · Exploitation active
- CVE-2026-20079Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability9,1 · Exploitation active