On September 24, 2025, Cisco published an out-of-band security advisory for a path traversal flaw in the web services interface of Cisco Secure Firewall ASA and Threat Defense software, tracked as CVE-2025-20362. The vendor stated that exploitation had been observed in the wild against unauthenticated VPN endpoints. For defenders, the significance is less about the CVSS number and more about the class of bug: a directory traversal reachable before authentication on an internet-facing device that terminates remote-access VPN sessions. This article breaks down the affected versions, the attacker TTPs mapped to MITRE ATT&CK, a compilable Sigma detection rule, and the exact patched releases Cisco recommends.
Background: what CVE-2025-20362 actually is
CVE-2025-20362 is a path traversal vulnerability in the web services interface of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. According to Cisco's security advisory, an unauthenticated, remote attacker could exploit the flaw by sending crafted HTTP requests to a vulnerable endpoint. A successful exploit could allow the attacker to read files outside the intended web root and, per Cisco, gain access to sensitive information that could be leveraged in follow-on attacks.
The advisory lists the CVSS v3.1 base score at 6.5 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. That vector is worth parsing: network reachable, no privileges, no user interaction, but confidentiality-only impact. In practice, a confidentiality-only bug on a VPN concentrator is not a low-severity finding. Files reachable through the web services layer can include configuration fragments, session artifacts, or certificate material, and those artifacts frequently feed a subsequent authentication bypass or credential-stuffing campaign. Cisco explicitly noted that it is aware of attempted exploitation in the wild, which is why this belongs on the KEV-class remediation list even at Medium severity.
Cisco advisory: "Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."
It is important not to conflate this with the earlier 2025 ASA VPN pre-auth RCE class of bugs. CVE-2025-20362 is a traversal, not a code execution primitive. The exploit chain value comes from what the traversal exposes, not from arbitrary code execution on the box itself.
Affected versions and the vendor advisory
Cisco's advisory covers both ASA and FTD branches because the web services component is shared. The affected release trains, per the advisory, include:
- Cisco ASA Software releases prior to the fixed releases listed in the advisory's Software Versions and Fixes table.
- Cisco FTD Software releases prior to the corresponding fixed releases.
Because Cisco maintains a live fix matrix, the authoritative list must be read from the advisory itself rather than reproduced from memory. The advisory at cisco-sa-asaftd-webvpn-Z5xNTp4k lists the first fixed release for each train. Cisco also published the vulnerability in the NVD entry for CVE-2025-20362.
Two operational notes matter here. First, ASA and FTD share the underlying HTTP service but ship on different release cadences, so an organization running both must patch both. Second, the web services interface is only reachable if the HTTP/HTTPS management or VPN web portal is enabled and exposed. Organizations that have already restricted the management interface to an out-of-band network still expose the VPN web portal by design, so the attack surface is not eliminated by management-plane hardening alone.
Attacker TTPs mapped to MITRE ATT&CK
Based on Cisco's description and the general pattern of edge-device traversal exploitation, the observable TTPs map cleanly onto a small set of ATT&CK techniques:
- T1190 — Exploit Public-Facing Application. The initial access vector. The attacker sends crafted HTTP requests directly to the ASA/FTD web services endpoint.
- T1083 — File and Directory Discovery. Traversal payloads (../ sequences, encoded variants) are used to enumerate reachable paths outside the web root.
- T1552.001 — Unsecured Credentials: Credentials In Files. If configuration or credential-bearing files are reachable, they become the pivot material.
- T1078 — Valid Accounts. Stolen VPN credentials or session artifacts are used for authenticated access in the follow-on phase.
- T1090.001 — Proxy: Internal Proxy. In observed edge-device campaigns, compromised VPN appliances are sometimes repurposed as internal pivot points.
Note that T1190 is the only technique that is definitively tied to this CVE by the vendor. The remaining techniques describe the plausible kill chain that defenders should hunt for in the same telemetry window, not confirmed attribution. Cisco did not attribute the observed exploitation to a named threat actor in the advisory.
Detection: Sigma rule for ASA/FTD web services traversal
The highest-fidelity signal is a traversal sequence in the URI of a request to the ASA/FTD web services endpoint. The following Sigma rule targets web access logs from the appliance or from a reverse proxy in front of it. It is syntactically valid Sigma and compiles with sigma-cli or pySigma.
title: Cisco ASA/FTD Web Services Path Traversal Attempt (CVE-2025-20362)
id: 8f4c2e10-7b6a-4d2f-9c1e-3a5b7d9e0f21
status: experimental
description: Detects directory traversal sequences in requests to Cisco ASA/FTD web services endpoints associated with CVE-2025-20362.
references:
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-Z5xNTp4k
- https://nvd.nist.gov/vuln/detail/CVE-2025-20362
author: CybernytronX
date: 2025-10-01
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- '/+CSCOE+/'
- '/+CSCOU+/'
- '/webvpn/'
selection_traversal:
cs-uri-query|contains:
- '../'
- '..%2f'
- '..%5c'
- '%2e%2e%2f'
- '%2e%2e/'
- '..%252f'
condition: selection_endpoint and selection_traversal
falsepositives:
- Vulnerability scanners performing authenticated traversal checks
- Legitimate applications that encode file paths with ../ in query parameters
level: high
For network-layer detection, a Suricata rule can catch the same pattern before it reaches the appliance. The rule below uses http.uri.raw and is valid Suricata 6/7 syntax:
alert http any any -> any any (msg:"CVE-2025-20362 Cisco ASA/FTD web services path traversal attempt"; flow:established,to_server; http.uri.raw; content:"/+CSCOE+/"; http.uri.raw; content:"../"; distance:0; classtype:attempted-recon; sid:90020362; rev:1;)
Neither rule is a substitute for vendor patching. They are compensating controls and detection coverage for the window between disclosure and full remediation, and for the long tail of appliances that never get patched.
Mitigation: patched releases and configuration hardening
Cisco's primary guidance is to upgrade to a fixed release listed in the advisory. Because the fixed-release matrix changes as Cisco ships maintenance releases, the correct action is to open the advisory, locate the train you are running, and apply the listed first fixed release. Cisco states there are no workarounds for the vulnerability itself, but the following configuration measures reduce exposure while patching is in flight:
- Restrict the web services interface to trusted management networks where operationally possible. The VPN web portal must remain reachable for remote users, but the management-facing portion does not.
- Disable unused web services features. If the clientless SSL VPN portal is not required, disable it. Fewer reachable endpoints means less traversal surface.
- Place an inline WAF or reverse proxy in front of the appliance and enable traversal normalization rules. This is a compensating control, not a fix.
- Rotate any credentials, certificates, or pre-shared keys that may have been exposed if you have evidence of exploitation. Treat traversal exposure as a credential-exposure event.
For FTD-managed deployments, the fix is applied through the FMC-managed upgrade path. For ASA in standalone mode, it is a direct image upgrade. Both paths are documented in the advisory's Software Versions and Fixes section.
Why this matters for defenders
The Medium CVSS score will cause some organizations to deprioritize CVE-2025-20362 behind higher-scored items in the same patch cycle. That is a mistake. Edge devices are the single most attractive initial-access target in enterprise environments because they are internet-facing by necessity, they terminate trust, and they are frequently the slowest class of asset to patch. A traversal that reads files outside the web root is a reconnaissance primitive. Reconnaissance primitives on VPN concentrators are how credential-harvesting and session-hijacking campaigns get their raw material. The correct posture is to treat CVE-2025-20362 as a credential-exposure event, not a file-read bug: patch on the vendor's timeline, hunt for traversal patterns in the days before and after patching, and rotate anything the appliance could have exposed. Cisco's confirmation of in-the-wild exploitation removes any ambiguity about urgency.
Sources
- Cisco Security Advisory: Cisco Secure Firewall ASA and FTD Web Services Path Traversal Vulnerability — primary vendor advisory; confirms affected products, fixed releases, and in-the-wild exploitation statement.
- NVD entry for CVE-2025-20362 — authoritative CVE record with CVSS vector and reference list.
- CISA Known Exploited Vulnerabilities Catalog — check for KEV listing and remediation due dates for Cisco ASA/FTD edge vulnerabilities.
- MITRE ATT&CK T1190: Exploit Public-Facing Application — technique reference for the initial access vector.
- MITRE ATT&CK T1083: File and Directory Discovery — technique reference for traversal-based enumeration.
Frequently Asked Questions
Is CVE-2025-20362 remotely exploitable without authentication?
Yes. Cisco's advisory states the vulnerability is exploitable by an unauthenticated, remote attacker via crafted HTTP requests to the web services interface. The CVSS vector confirms PR:N and AV:N.
Does CVE-2025-20362 allow remote code execution?
No. The advisory describes a path traversal leading to unauthorized file read and information disclosure. It is not an RCE primitive. Its value to an attacker is the data it exposes, which can be used in follow-on credential or session attacks.
Are there workarounds if I cannot patch immediately?
Cisco states there are no workarounds that address the vulnerability. The only complete fix is a software upgrade to a listed fixed release. Configuration changes such as restricting the management interface or disabling unused web services features reduce exposure but do not eliminate the flaw.
Which Cisco products are affected?
Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. The web services component is shared, so both branches require patching. The advisory's Software Versions and Fixes table is the authoritative source for fixed releases per train.
How should I hunt for exploitation in my environment?
Search web access logs and any inline proxy or WAF logs for traversal sequences (../, ..%2f, %2e%2e%2f) in requests to /+CSCOE+/, /+CSCOU+/, or /webvpn/ paths. Correlate with any subsequent authentication anomalies from the same source IP. The Sigma and Suricata rules in this article are starting points.
Should I rotate credentials after suspected exploitation?
Yes. Treat confirmed or suspected traversal exploitation as a credential-exposure event. Rotate VPN credentials, certificates, and pre-shared keys that the appliance could have exposed, and review authentication logs for anomalous successful logins from new source IPs.
Need expert help with this?
CybernytronX helps security teams validate edge-device exposure, build detection coverage for traversal and authentication-bypass campaigns, and stand up SOC workflows that catch exploitation before it becomes a breach. Our Ethereon AI threat-detection platform correlates edge telemetry with identity and endpoint signals to surface the reconnaissance-to-credential-theft kill chain. If you are triaging CVE-2025-20362 across a large ASA/FTD estate, our team can help you scope exposure and prioritize remediation. Reach us at cybernytronx.com/contact.html or explore Ethereon.