Cisco ASA and FTD Zero-Day Vulnerabilities

THE THREAT

On September 25th, 2025, Cisco disclosed two zero-day vulnerabilities, CVE-2025-20333 (CVSS: 9.9) and CVE-2025-20362 (CVSS: 6.5), in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The disclosure confirmed that the vulnerabilities are being actively exploited in the wild; CVE-2025-20333 allows authenticated, remote attackers to execute arbitrary code on vulnerable ASA and FTD instances, while CVE-2025-20362 enables remote attackers to access restricted URL endpoints without authentication.

Cisco has not released technical details and no Proof-of-Concept (PoC) exploit code is publicly available at the time of writing. Cisco believes these exploits are associated with the ArcaneDoor cyber espionage campaign observed earlier in 2024. Following Cisco's security advisory release, the Cybersecurity and Infrastructure Security Agency (CISA) published an emergency directive mandating federal agency to identify and mitigate the vulnerabilities immediately.

Cisco strongly recommends updating impacted products to the fixed software versions. Failure to apply the necessary patches may lead to full system compromise, posing a significant risk to organizations' network.

What we're doing about it

• eSentire MDR for Log has detections in place to identify Cisco ASA anomalous sign-in activity
• eSentire's Tactical Threat Response team has created new eSentire MDR for Network detections to identify LINE VIPER activity
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches provided by Cisco
  • Cisco provides a Software Checker tool that should be used to identify vulnerable devices
• If patching is not immediately possible, risk can "be mitigated by disabling all SSL/TLS-based VPN web services"
• If a device is found to be compromised, reset all associated passwords, certificates, and keys after upgrading to a secure version

Additional information

In May 2025, Cisco, in coordination with the Australian Signals Directorate Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the United Kingdom's National Cyber Security Centre (NCSC) and CISA, conducted an investigation into incidents affecting specific Cisco ASA 5500-X Series devices equipped with Cisco Secure Firewall ASA Software, particularly those with the VPN web service enabled. The attackers successfully exploited these vulnerable devices to deploy malware, execute remote commands, and potentially exfiltrate data. The investigation uncovered two zero-day vulnerabilities, identified as CVE-2025-20333 and CVE-2025-20362, which were leveraged in the attacks.

CVE-2025-20333 and CVE-2025-20362 both exist due to improper validation of user-supplied input in HTTP(S) requests. An attacker possessing valid VPN user credentials could exploit CVE-2025-20333 by sending specially crafted HTTP requests to a vulnerable device, thereby enabling the execution of arbitrary code with root privileges, which could potentially lead to the complete compromise of the affected device. Similarly, an attacker could exploit CVE-2025-20362 by sending crafted HTTP requests to a targeted web server on the device, allowing them to access a restricted URL without requiring authentication.

Cisco's investigation uncovered a sophisticated attack that employed advanced evasion techniques, including disabling logging, intercepting CLI commands, and deliberately crashing devices to thwart diagnostic analysis. The threat actor was observed modifying the ROMMON to maintain persistence through reboots and software upgrades on Cisco ASA 5500-X Series devices that do not have secure boot capabilities. Based on these findings, Cisco assessed with high confidence that this new activity is associated with the same threat actor, tracked as UAT4356, who was behind the ArcaneDoor attack campaign reported by Cisco in early 2024.

On September 25th, 2025, the UK's NCSC published a malware analysis report that provided detailed insights into RayInitiator, a persistent, multi-stage bootkit. This bootkit facilitates the deployment of LINE VIPER, a user-mode shellcode loader, on Cisco ASA 5500-X Series lacking secure boot. Both LINE VIPER and RayInitiator use victim-specific tokens, a method previously seen in LINE DANCER and LINE RUNNER, which were utilized in the 2024 ArcaneDoor threat activity.

In addition to the two actively exploited vulnerabilities, Cisco disclosed a third critical vulnerability, CVE-2025-20363 (CVSS: 9.0) in the web services of Cisco Secure Firewall's ASA Software, FTD Software, IOS Software, IOS XE Software, and IOS XR Software. It could allow an unauthenticated, remote attacker (for Cisco ASA and FTD Software) or an authenticated, remote attacker with low user privileges (for Cisco IOS, IOS XE, and IOS XR Software) to execute arbitrary code on an affected device. As of the time of writing, this flaw has not been reported to be exploited in the wild.

With the widespread exploitation of CVE-2025-20333 and CVE-2025-20362 confirmed, it is critical for organizations to prioritize mitigation by upgrading to a secure version. For additional guidance on mitigation, organizations are advised to refer to the recommendations provided in Cisco's report on exploitation activity.

References:

[1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
[2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
[3] https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
[4] https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
[5] https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
[6] https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
[7] https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
[8] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O