Product:
Cisco Secure Firewall
Summary
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software could allow an unauthenticated, remote attacker to access restricted URL endpoints without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-20362 |
Exploitation
To exploit this vulnerability, an attacker needs to send specially crafted HTTP requests to the targeted web server on the affected device. If successful, the attacker can access restricted URLs that should normally require authentication, thereby gaining unauthorized access to sensitive information or functionalities.
Affected Products
- Cisco Secure Firewall Adaptive Security Appliance Software: Affected by the vulnerability allowing unauthorized access to restricted URLs.
- Cisco Secure Firewall Threat Defense Software: Also vulnerable, enabling similar unauthorized access through crafted HTTP requests.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco for the affected products. Additionally, implementing strict access controls and monitoring network traffic can help prevent unauthorized access attempts.