Loading story…
Attackers are actively exploiting Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) vulnerabilities to compromise internet-facing VPN appliances. CVE-2025-20362, an authentication bypass rated CVSS 6.5, allows unauthenticated access to restricted VPN-related endpoints through crafted HTTP(S) requests when VPN web services are enabled. CERT Polska warned that attackers chain it with CVE-2025-20333 to achieve unauthenticated arbitrary code execution with administrator privileges on vulnerable ASA 5500-X devices. Cisco also disclosed CVE-2025-20363, which permits an authenticated user to execute code as root. CrowdSec reported persistent exploitation activity associated with CVE-2025-20362, tracking 292 attacking IP addresses overall and 2,330 signals in its latest reported 89-day window.
Hunter Strategy attributed exploitation of the three vulnerabilities to the state-aligned ArcaneDoor cluster, also tracked as UAT4356 and Storm-1849. Its report described token harvesting, logging interference, deliberate device crashes, and firmware or ROMMON modifications intended to preserve access through reboots and software upgrades, supporting covert access to VPN sessions and internal networks. Organizations should immediately install Cisco’s fixed releases, using the vendor advisory and Software Checker to select the correct version, and investigate affected devices using CISA’s compromise-checking guidance. Unsupported appliances should be disconnected; suspected persistent compromise warrants boot and firmware integrity checks, with rebuilding or replacement where persistence is confirmed. Detected incidents should be reported to the appropriate national CSIRT.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
The CrowdSec network first observed exploitation of CVE-2025-20362. Its subsequent monitoring recorded continued activity over several months.
CrowdSec released detection coverage for exploitation of the Cisco ASA and FTD VPN authentication-bypass vulnerability.
Security bulletin 36/2025 warned that attackers were chaining CVE-2025-20362 and CVE-2025-20333 to take control of vulnerable Cisco ASA 5500-X devices without authentication. It urged immediate patching, compromise checks using CISA's hunting instructions, and reporting detected incidents to the appropriate national CSIRT.
Cisco released patched ASA and FTD builds addressing the reported vulnerabilities. The applicable fixed release depends on the software branch and can be identified through Cisco's advisories and Software Checker.
Cisco published CVE-2025-20362, an authentication-bypass vulnerability in the ASA and FTD VPN web server. Crafted HTTP(S) requests can allow unauthenticated attackers to access restricted VPN-related endpoints.
The April 2024 ArcaneDoor campaign deployed Line Dancer and Line Runner malware on Cisco ASA appliances. Cisco later assessed with high confidence that the operators behind the newer attacks were responsible for this earlier campaign.
ProjectDiscovery published a detection template for CVE-2025-20362 that was referenced in the vulnerability analysis.
Rapid7 researcher Ryan Emmons published an analysis explaining how crafted requests against the WebVPN path can reach a restricted file-handling endpoint without valid credentials. Rapid7 also described the vulnerability's role in attack chains leading to deeper device compromise.
Hunter Strategy attributed exploitation of CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363 to ArcaneDoor, also tracked as UAT4356 and Storm-1849. The report described firmware and ROMMON persistence, logging interference, and deliberate device crashes, citing Cisco's high-confidence assessment of continuity with the April 2024 operators.
The Hunter Strategy report describes pre-disclosure reconnaissance against internet-facing AnyConnect and WebVPN portals, including automated scanning and fingerprinting before tailored exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
crowdsec.net
Open sourcemoje.cert.pl
Open sourceblog.hunterstrategy.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple critical vulnerabilities have been discovered in the Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) WebVPN components, which are being actively exploited in the wild. The vulnerabilities, identified as CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, allow attackers to bypass authentication and achieve remote code execution (RCE) as root on affected devices. CVE-2025-20362 is an unauthenticated authorization bypass that enables attackers to access restricted endpoints without valid credentials, serving as a key component in exploit chains. When combined with CVE-2025-20333, attackers can send malicious HTTPS requests to execute arbitrary code as root, even without prior authentication. CVE-2025-20363 is a related flaw that also enables unauthenticated RCE on ASA/FTD devices and authenticated RCE on some Cisco IOS components. These vulnerabilities affect Cisco ASA versions 9.16 through 9.23 and Cisco FTD versions 7.0 through 7.7, with specific software images requiring validation against Cisco advisories. Cisco and CISA have confirmed active exploitation and widespread scanning for these vulnerabilities, prompting CISA to issue Emergency Directive 25-03 on September 25, 2025, mandating immediate action by federal agencies. The threat actor responsible for these attacks is attributed to the same group behind the ArcaneDoor (UAT4356) state-sponsored espionage campaign first observed in 2024. Organizations are urged to patch or upgrade to Cisco’s fixed releases without delay, and to restrict or disable vulnerable devices if immediate upgrades are not possible. Compromised devices should be isolated and thoroughly investigated for signs of threat actor presence. Cisco has provided detailed guidance for detection, and CISA’s Malware Next Generation tool can be used to hunt for indicators of compromise. Security researchers, including Rapid7, have published technical analyses and exploit chains demonstrating the severity and ease of exploitation. The vulnerabilities are considered highly critical due to their unauthenticated nature and the potential for full device compromise, which could lead to further lateral movement within affected networks. The rapid response from both Cisco and CISA underscores the urgency and scale of the threat. Organizations using Cisco ASA or FTD devices should assume exposure if running affected versions and prioritize remediation. The vulnerabilities highlight the ongoing targeting of network edge devices by sophisticated threat actors, particularly those engaged in espionage. Failure to address these vulnerabilities could result in significant operational disruption and data compromise. The security community continues to monitor for new exploitation techniques and advises ongoing vigilance. The release of proof-of-concept code and active scanning increases the risk of opportunistic attacks by additional threat actors. Timely patching and adherence to Cisco and CISA recommendations are essential to mitigate risk from these critical vulnerabilities.
Jun 29, 2026
Cisco confirmed that multiple government agencies engaged its incident response teams in May 2025 to investigate targeted attacks against Cisco Adaptive Security Appliance (ASA) 5500-X Series devices running Cisco Secure Firewall ASA Software with VPN web services enabled. Attackers exploited multiple zero-day vulnerabilities to implant malware, execute commands, and potentially exfiltrate data from compromised devices. The threat actor demonstrated advanced evasion techniques, including disabling logging, intercepting CLI commands, and intentionally crashing devices to hinder forensic analysis. Cisco’s investigation, which involved providing instrumented images and analyzing packet captures and firmware, led to the identification of a critical memory corruption bug in the ASA software. The company assessed with high confidence that the activity was linked to the same threat actor behind the ArcaneDoor campaign previously reported in 2024. While the vulnerable software is present on other hardware platforms and in Cisco Secure Firewall Threat Defense (FTD) Software, there is no evidence of successful compromise beyond the ASA 5500-X Series. Cisco published detailed detection guidance, highlighting that the threat actor continues to scan for vulnerable devices using frequently changing IP addresses, and that scanning activity alone does not indicate compromise. Only specific ASA 5500-X models running certain software releases with VPN web services enabled have been confirmed as compromised. The threat actor suppressed specific syslog messages in memory as a forensic countermeasure, and a downward shift in these logs may indicate malicious activity. On September 25, 2025, Cisco released security advisories addressing critical vulnerabilities, including CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363, affecting a range of ASA and FTD software versions. The Canadian Centre for Cyber Security issued alerts urging organizations to review Cisco’s advisories, apply mitigations, and update affected devices. The vulnerabilities allow for remote code execution and unauthorized access via VPN web services and HTTP servers on affected firewall products. Cisco’s advisories provided a comprehensive list of affected software versions and recommended immediate action to mitigate risk. The incident underscores the sophistication of the threat actor, the importance of timely patching, and the need for enhanced monitoring of VPN-enabled firewall devices. Cisco’s response included collaboration with affected customers, deployment of enhanced detection capabilities, and ongoing monitoring for further malicious activity. Organizations are advised to follow Cisco’s guidance, monitor for suppressed syslog IDs, and engage Cisco Technical Assistance Center if compromise is suspected. The campaign highlights the persistent targeting of network edge devices by advanced threat actors and the criticality of maintaining up-to-date security controls.
Aug 31, 2026
Cisco has disclosed multiple critical zero-day vulnerabilities affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Software, which are actively being exploited in the wild. The vulnerabilities, tracked as CVE-2025-20362 and CVE-2025-20333, impact the VPN web server component of these devices and can lead to remote code execution or unauthorized access. According to Cisco's advisory, CVE-2025-20362 allows unauthenticated, remote attackers to access restricted URL endpoints without authentication by sending specially crafted HTTP requests. CVE-2025-20333, on the other hand, enables authenticated attackers with valid VPN credentials to execute arbitrary code as root, potentially resulting in full device compromise. CISA has responded by adding both vulnerabilities to its Known Exploited Vulnerabilities Catalog and issuing an emergency directive (ED 25-03) that requires federal agencies to identify, analyze, and mitigate any potential compromises immediately. The vulnerabilities stem from improper validation of user-supplied input in HTTP(S) requests, making it possible for attackers to bypass security controls. Cisco has provided a list of vulnerable configurations, including those using AnyConnect IKEv2 Remote Access with client services enabled. The CVE-2025-20333 vulnerability is rated as critical with a CVSS score of 9.9, underscoring the severity of the threat. Exploitation of these flaws could allow attackers to gain root-level access, execute arbitrary code, and take full control of affected devices. The vulnerabilities affect a wide range of Cisco products, including ASA, FTD, and potentially IOS, IOS XE, and IOS XR software, as described in related advisories. Cisco has urged all customers to apply patches immediately to prevent exploitation. The vulnerabilities are being actively targeted, increasing the urgency for organizations to remediate affected systems. Attackers exploiting these flaws could use compromised devices as entry points into broader enterprise networks. The technical details highlight the importance of proper input validation in web services exposed to the internet. Organizations are advised to review their firewall configurations and ensure that all relevant updates are applied. The rapid response from CISA and Cisco reflects the high risk posed by these vulnerabilities to both public and private sector networks. Security teams should monitor for signs of compromise and follow Cisco's mitigation guidance to reduce exposure. The incident demonstrates the ongoing threat posed by zero-day vulnerabilities in widely deployed network security appliances.
Jun 29, 2026