Outbreak Alert: Cisco ASA and FTD Firewall Zero-day

[smallick]

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2025-20362
CVE Title	Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	90/100
Epss Score	0.33379
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (UAT4356)
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	0
Darknet Mention(s)	4 (crdclub, xss)
Telegram Mention(s)	1 (𝐃𝐞𝐟𝐚𝐜𝐞𝐏𝐞𝐫𝐮 𝐂𝐡𝐚𝐭)
FortiRecon Intelligence Reporting(s)	3 (Darknet), 25 (OSINT), 11 (FortiGuard Research)
Vendor Advisory:	https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn... https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362

CVE ID	CVE-2025-20333
CVE Title	Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	90/100
Epss Score	0.07153
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (UAT4356)
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	0
Darknet Mention(s)	3 (crdclub, exploit)
Telegram Mention(s)	1 (𝐃𝐞𝐟𝐚𝐜𝐞𝐏𝐞𝐫𝐮 𝐂𝐡𝐚𝐭)
FortiRecon Intelligence Reporting(s)	2 (Darknet), 24 (OSINT), 9 (FortiGuard Research)
Vendor Advisory:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333 https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn...