Cisco ASA & FTD Zero-Day Vulnerabilities (CVE-2025-20333, CVE-2025-20362): Exploited in Active Attacks
Cisco has confirmed two zero-day vulnerabilities — CVE-2025-20333 and CVE-2025-20362 — impacting ASA (Adaptive Security Appliance) and FTD (Firepower Threat Defense) devices. Both flaws are already being exploited in real-world attacks by an advanced persistent threat group known as UAT4356 (STORM-1849).
If you manage Cisco perimeter firewalls or VPN devices, patching and incident response should be your top priority.
What Are CVE-2025-20333 and CVE-2025-20362?
- CVE-2025-20333 (Critical, RCE)
A remote code execution flaw in the VPN Web Server module of Cisco ASA/FTD. Exploitation allows attackers to run arbitrary code with system privileges. - CVE-2025-20362 (High, Unauthorized Access)
An authentication bypass bug in the VPN Web Server, allowing attackers to gain unauthorized access. - CVE-2025-20363 (Critical, RCE – not exploited yet)
A related web services vulnerability affecting multiple Cisco platforms.
⚠️ Why it matters: CVE-20333 and CVE-20362 can be chained together, giving attackers full control of vulnerable devices.
Who Is Behind the Exploits?
Cisco attributes the campaign to UAT4356 / STORM-1849, the same group behind the ArcaneDoor espionage campaign (2024).
Malware tools observed in these attacks include:
- RayInitiator → A stealth bootkit providing persistent access.
- LINE VIPER → A shellcode loader supporting HTTPS/ICMP communication channels.
The UK’s NCSC has also issued technical alerts with Indicators of Compromise (IoCs).
Affected Cisco Products
- ASA Software (all major versions prior to patched releases)
- Firepower Threat Defense (FTD) appliances with public-facing VPN enabled
If your devices host AnyConnect or SSL VPN portals, they are at the highest risk.
Mitigation & Patch Guidance
Cisco has released patched versions — admins should:
- Upgrade immediately to the recommended ASA/FTD releases.
- Restrict public exposure of the VPN web interface where possible.
- Implement access controls (ACLs, IP restrictions, geo-blocking).
- Scan networks with updated plugins (e.g. Tenable, Nessus) to identify vulnerable systems.
- Check for persistence — patching alone does not remove implants. Conduct forensic reviews.