CISA Warns of Cisco Firewall 0-Day Vulnerabilities Actively Exploited in the Wild
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
CISA has issued an Emergency Directive mandating immediate action to mitigate two critical zero-day vulnerabilities,CVE-2025-20333andCVE-2025-20362,actively exploited against Cisco Adaptive Security Appliances (ASA) and select Firepower platforms.
The vulnerabilities allow unauthenticated remote code execution and privilege escalation, enabling advanced threat actors to modify read-only memory (ROM) for persistence through reboot and system upgrades.
Exploit Cisco ASA Hardware Zero-Days
CISA links this campaign to the ArcaneDoor activity first identified in early 2024, during which adversaries demonstrated the capability to manipulate ASA ROM as early as 2024.
Although Secure Boot on Firepower Threat Defense (FTD) appliances detects ROM manipulation, ASAs lack this protection, making them prime targets.
Cisco has released security updates addressing both vulnerabilities:
Failure to remediate poses an unacceptable risk to federal information systems and critical infrastructure.
CVE Identifier Title CVSS 3.1 Score Severity CVE-2025-20333Cisco ASA Remote Code Execution Zero-Day9.8CriticalCVE-2025-20362Cisco ASA Privilege Escalation Zero-Day7.2High
Emergency Directive
For all public-facing ASA hardware, perform CISA’s Core Dump and Hunt Instructions Parts 1–3 and submit core dumps via the Malware Next Gen portal by September 26, 2025, 11:59 PM EDT.
If “Compromise Detected,” disconnect (but do not power off), report to CISA, and coordinate incident response. If “No Compromise Detected,” proceed to software updates or device decommissioning.
Permanently disconnect ASA hardware with end-of-support on or before September 30, 2025. Agencies unable to comply must apply Cisco-provided software updates by September 26 and plan for decommissioning.
Download and apply the latest Cisco updates for ASA hardware models supported through August 31, 2026, and for all ASAv and FTD appliances by September 26, 2025.
Agencies remain responsible for maintaining inventories and ensuring compliance. CISA will report cross-agency status and outstanding issues to senior leadership by February 1, 2026.
#Cyber_Security_News #Vulnerability #Vulnerability_News #cyber_security #cyber_security_news #vulnerability
Оригинальная версия на сайте:
CISA Warns of Cisco Firewall 0-Day Vulnerabilities Actively Exploited in the Wild
Author: Florence NightingaleCISA has issued an Emergency Directive mandating immediate action to mitigate two critical zero-day vulnerabilities,CVE-2025-20333andCVE-2025-20362,actively exploited against Cisco Adaptive Security Appliances (ASA) and select Firepower platforms.
The vulnerabilities allow unauthenticated remote code execution and privilege escalation, enabling advanced threat actors to modify read-only memory (ROM) for persistence through reboot and system upgrades.
Exploit Cisco ASA Hardware Zero-Days
CISA links this campaign to the ArcaneDoor activity first identified in early 2024, during which adversaries demonstrated the capability to manipulate ASA ROM as early as 2024.
Although Secure Boot on Firepower Threat Defense (FTD) appliances detects ROM manipulation, ASAs lack this protection, making them prime targets.
Cisco has released security updates addressing both vulnerabilities:
- CVE-2025-20333 allows remote code execution on vulnerable ASAs.
- CVE-2025-20362 permits privilege escalation to root-level access.
Failure to remediate poses an unacceptable risk to federal information systems and critical infrastructure.
CVE Identifier Title CVSS 3.1 Score Severity CVE-2025-20333Cisco ASA Remote Code Execution Zero-Day9.8CriticalCVE-2025-20362Cisco ASA Privilege Escalation Zero-Day7.2High
Emergency Directive
For all public-facing ASA hardware, perform CISA’s Core Dump and Hunt Instructions Parts 1–3 and submit core dumps via the Malware Next Gen portal by September 26, 2025, 11:59 PM EDT.
If “Compromise Detected,” disconnect (but do not power off), report to CISA, and coordinate incident response. If “No Compromise Detected,” proceed to software updates or device decommissioning.
Permanently disconnect ASA hardware with end-of-support on or before September 30, 2025. Agencies unable to comply must apply Cisco-provided software updates by September 26 and plan for decommissioning.
Download and apply the latest Cisco updates for ASA hardware models supported through August 31, 2026, and for all ASAv and FTD appliances by September 26, 2025.
Agencies remain responsible for maintaining inventories and ensuring compliance. CISA will report cross-agency status and outstanding issues to senior leadership by February 1, 2026.
#Cyber_Security_News #Vulnerability #Vulnerability_News #cyber_security #cyber_security_news #vulnerability
Оригинальная версия на сайте:
