Cisco Secure Firewall Adaptive Security Appliance Software VPN Web Server Unauthorized Access (cisco-sa-asaftd-webvpn-YROOTUW)

#TRUSTED 72279a0b19dca56e21ab9daa761f384b04b5391e460d199174dac79b0e5202d6dfa66caa7c75cf0650324a76015eeb2f38017c5965d556e117a92726450d74e8d4ecb1bf5b1f01877f2f67b80706adb6a48e2a7659f08a55ad21c160c26a77ff95c03519f64a0c2ed4bae17b77e1113acb3981f5b1155e4d51752a676b2e21c21e94392ba9c0721128ac002ce0ce4a9240887f66de80709600bc0722956ec6826b25aaf21ba30b084ed76a9bfd855fd55f87966b74d9397284b08995053f982d4015df841d668f2315d6a393d2a721e6e3b773afaef3ad62c85d2b3774bff7cfd9db8a03c2afea491bec70ce25ce85e7ecbd3eb30f8f82df37a0f1763e4e95c7fa706a074cfb458e6c1bb19d63318933abe1b56a246f5adb19ba9db7171c7a63327a95a9bd9ecf5d6921483c826214c5779afcf10622b0ff8c1646ba505e6847b8c87f43658fe6243f674650cce83112411eb96425ce96f7483d061ab5ecb1f095e28c3e0a6bccb4ecd8149981007f4dd4fe5d6d1ea926a1a6a8ba8ca49e403bfe7e785e0dc1b1b1812ef55195938df70a248350fc95b84cc4573cb1d3cf190f584a42901733bf06e7306a552b404761513008a1da317b81059c2e84b61b82fedabd173e01898ee800f5b5384fbb2e96dc9f3eacce20adcfb82b9e3a5d7f160123704e0ba4b9a095e559be869f305e2988e976cc395a67ea0b2b00d4fe24dcf5
#TRUST-RSA-SHA256 71ca3b44d82211feb076c6b73558e6879618a210d073ec0f3aa820971aa88e5531e0876943cad8dc9187b12cf5bbf1e1ada8cc49b60a28297af1f738829f453acf1771016eeda8f560f7a7e70741772f3d1064ac9fa5966548d547115164af30024b985335007c8623a2d07466b446f4b13f6ce180c67ea5c2b69422c8d5f067fe34f2e05d25e595db07efba1a928c9bdacf67c8a364aa1ada0b0bbf014d806cca3ed88549bb36c865a5b689a9943db057bd4752189911bf889b545fce7a25c25b8de52a098adb7b5ff03a4c697fcf2408aacaafec1a7b48d7bb1bb648ab10dec972a7b3dc282642b026ff7ee91f3bd6d26bb2a6cae6eb60427bb8acc9fa59dad8f4beeb8b47b93b441f5385756c489f6d560da6a8c0c344fab9d466c73934f25d64b71ac5eb68421d95ace2e70cb3c1444fee7a9bc4c36ef3dc324822489b35b6b45df73464179c355f646eb677a166204999d1131c2e6d4dcae3e496c825eadf8717dc00c4340af50bc50f34cdd19590ac5762566ac7d7a1e1500449656a2f7c4fedfcf9eeafe4ed7a61e26bb352c576f6f790a4156e5543b110f13f3b9e4a8010b8cd73edf5f545c6fbefcfb5c5f9e32ef51444e9a02b7af35b299eca07a7b32486dc4294ca5ed27a25c1e335b02f3c13ddb4b62a89a117e009a787a18341d834f261517a1b64c53ed8017c5647d1f43ab4a2a90971733a7ed0fd398031bb
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265965);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/28");

  script_cve_id("CVE-2025-20362");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwq79815");
  script_xref(name:"CISCO-SA", value:"cisco-sa-asaftd-webvpn-YROOTUW");
  script_xref(name:"IAVA", value:"2025-A-0702");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/09/26");

  script_name(english:"Cisco Secure Firewall Adaptive Security Appliance Software VPN Web Server Unauthorized Access (cisco-sa-asaftd-webvpn-YROOTUW)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a vulnerability.

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
    and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to
    access restricted URL endpoints without authentication that should otherwise be inaccessible without
    authentication.  This vulnerability is due to improper validation of user-supplied input in HTTP(S)
    requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web
    server on a device. A successful exploit could allow the attacker to access a restricted URL without
    authentication. (CVE-2025-20362)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d638962");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwq79815");
  # https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c68d455");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwq79815");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20362");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(862);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/Cisco/ASA/model");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

var product_info = cisco::get_product_info(name:'Cisco Adaptive Security Appliance (ASA) Software');

var vuln_ranges = [
  {'min_ver':'9.16', 'fix_ver':'9.16.4.85'},
  {'min_ver':'9.17', 'fix_ver':'9.18.4.67'},
  {'min_ver':'9.19', 'fix_ver':'9.20.4.10'},
  {'min_ver':'9.22', 'fix_ver':'9.22.2.14'},
  {'min_ver':'9.23', 'fix_ver':'9.23.1.19'},
];

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['anyconnect_client_services'],
  WORKAROUND_CONFIG['mobile_user_security'],
  WORKAROUND_CONFIG['ssl_vpn']
];

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_WARNING,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwq79815',
  'cmds'    , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);