Cisco Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access (cisco-sa-asaftd-webvpn-YROOTUW)

#TRUSTED 43cd90e507df99e23955c7d9b4f747bbe30c67a3fa00935b8431e654ddde1412b8acfdea7c481845c0be8083bea3815900edd26616c4ec345f6ae505dfa6cb48efee1da4b6fde941624b7fe40728c1cccfe3bd51c4785d8269c64f4921dba0fb7f439a74d4c5dce46d66a16c792f5dd31ed01b83d2f6189c0ccc78a98bbd2f7ec91276982b425924d42d0d51e3464b4d4cf859527736f402562d417a4d004010790c1d0986a261ea450ac603aedb3ce97bb2c9f72391e28253ac49a7ddfea94ea076c249c6c46bbb1a227ac7ee4389f5fcd2656d23f2db2ac5e5dc51bad5850bd768d02c3c1b56b8264bac660c7b8253887abacc46f158d17ab61615db1cae7452e7357f21de912972d6ecf2977e5209521efd6b2a4fc61c066fb1d3f5ac7fbbcb2cc7944f7ccfff72e3242bcd62a11d363bcb2b7b13e7af571e10f590064a39402339acdf401c0dd3a44a6155699edc84d50f5bb1bbbdd49039e7e624246f8eac36064243fc742ab66f6f16b41b7111026c570386e7a4fc2d6dff6d6cc937521419a6c03c065490b70b83b41e51d0fe807c38d6437122535c1c42906b17f4688fffcd3bbfb2c97c27bd16f08bcaa443a88f725c88ea021d2bd668e6bfe3f0c2bb1a0902943a95d19f261ef466bafcbb17c281aa32412bf8ca269c5feb54df61fc0f5d189dc6f2a29c91384e08f37bbe9d169de2d0160b40ff093e63afc505c4
#TRUST-RSA-SHA256 35d80effef384bb86237525ecb743bfdd60bf85307a3382b54dcbff38660a203aca71f4a392ae8225008082bd46c2b6dfba49890dbbf90a6e5a2b88d3243a8340bd86f654c64982d826019d53ae6688f3f40d5ba0465d6bd0a831a54e3aa14ab0ded2956034a3e2e6bd2a347023b7094fbe3c68a433ecd89635482031681a1ba1a8e183752bab6bff83a75d9839066ed89f4dd413bb213cc64cec80534a89a36fbbfe05b412680039fbc5594341369943d3e44f90a3f1071f5cc6f33aba4f8d373d3dc6d7056d00ee06aa60314c4cae09d2c9335deae91499355f8778b02816648604ee2f10b5e33719774d11c9a009dca2065a1cedc40f563bc722a18eb5d49f0e4bbf65adc0630fba3f53bbf25afd8de0d067789218ccf6dc9d3bb0f9dfad7cf9401ad3163bd0cae87528acfaa1351da52f5879b05aeeed2ddfbe571ce57474efe492157071860a1a8cb5d81d8ac53dff0cf8d8d65ad1c6f2c3504ae68e107d1a703cc3b1ccdae1858745cf84dcb5b0f9e59cc9164a9b3eeee4333af83bf35cdd97d7af09a3d2f57757623b31affe8148d18f8e54bc8af9b18f110f74abc4b7172aea4bb6d359586898b264ff24c4a71d04c043df78af3dfa6203a89b56518308ffd4cb1fc00f1fe11a06c6fdd35c412ad6bba4c689978eea51aabbc09840b9ea3e3883f281f63b43e740f13dc958f984dfd0aadeca98aaccdf04d958d9bf6
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265966);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/28");

  script_cve_id("CVE-2025-20362");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwq79815");
  script_xref(name:"CISCO-SA", value:"cisco-sa-asaftd-webvpn-YROOTUW");
  script_xref(name:"IAVA", value:"2025-A-0702");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/09/26");

  script_name(english:"Cisco Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access (cisco-sa-asaftd-webvpn-YROOTUW)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability.

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
    and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to
    access restricted URL endpoints without authentication that should otherwise be inaccessible without
    authentication.  This vulnerability is due to improper validation of user-supplied input in HTTP(S)
    requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web
    server on a device. A successful exploit could allow the attacker to access a restricted URL without
    authentication. (CVE-2025-20362)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d638962");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwq79815");
  # https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c68d455");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwq79815");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20362");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(862);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:firepower_threat_defense");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_enumerate_firepower.nbin");
  script_require_keys("installed_sw/Cisco Firepower Threat Defense");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

var product_info = cisco::get_product_info(name:'Cisco Firepower Threat Defense');

var vuln_ranges = [
  {'min_ver':'7.0', 'fix_ver':'7.0.8.1'},
  {'min_ver':'7.1.0', 'fix_ver':'7.2.10.2'},
  {'min_ver':'7.3.0', 'fix_ver':'7.4.2.4'},
  {'min_ver':'7.6.0', 'fix_ver':'7.6.2.1'},
  {'min_ver':'7.7.0', 'fix_ver':'7.7.10.1'}
];

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['anyconnect_client_services'],
  WORKAROUND_CONFIG['ssl_vpn']
];

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_WARNING,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwq79815',
  'cmds'    , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);