Active Zero-Day Exploitation on Cisco ASA and FTD Devices

Cisco ASA and FTD Zero-Day Exploitation: CVE-2025-20333, CVE-2025-20362, CVE-2025-20363

Summary

In August 2025, a series of critical zero-day vulnerabilities were identified in Cisco ASA and Cisco FTD devices, actively exploited by the state-sponsored threat actor UAT4356 (aka Storm-1849). The exploited flaws — CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363 — enable attackers to achieve unauthenticated remote root access.

• CVE-2025-20333: VPN web server buffer overflow leading to remote code execution (RCE) as root.

• CVE-2025-20362: Authentication bypass exposing restricted VPN endpoints.

• CVE-2025-20363: Unauthorized access vulnerability further enabling system compromise.

Attackers deploy advanced persistent malware including the RayInitiator bootkit and the LINE VIPER loader, manipulating firmware and ROMMON to survive reboots and upgrades. Exploitation involves anti-forensic techniques such as log suppression and device crashes, significantly complicating detection and response.

Vulnerability Details

• Exploitation Method: Threat actors chain CVE-2025-20362 with CVE-2025-20333 to bypass authentication and execute arbitrary code as root.

• Persistence Mechanism: Malware modifies the firewall’s firmware and ROM Monitor, ensuring persistence beyond patches and system restarts.

• Target Scope: Primarily impacts older ASA 5500-X series devices, lacking secure boot features.

• Associated Malware:

  • RayInitiator: Bootkit providing stealth persistence.

  • LINE VIPER: User-mode loader for deploying additional payloads.

• Forensic Challenges: Attackers disable syslog events (302013, 302014, 609002, 710005), tamper with checkheaps counters, and trigger device crashes to cover tracks.

Recommendations

• Immediate Patch Application: Upgrade ASA and FTD devices to Cisco’s fixed versions addressing CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363.

• Restrict Remote Exposure: Temporarily disable or restrict VPN/web access with ACLs and IP allow-lists until patching is complete.

• Enable and Monitor Logging: Re-enable syslog messages, validate heap check counters (show checkheaps), and investigate anomalies such as frozen counters or missing logs.

• Check for Persistence: Inspect for artifacts like firmware_update.log and monitor console output for “Verifying bootloader/ROMMON” errors post-upgrade.

• Rebuild or Replace Compromised Devices: If persistence is confirmed, treat as a high-confidence compromise requiring full rebuild or hardware replacement.

MITRE ATT&CK TTPs

• Initial Access: T1190 (Exploit Public-Facing Applications), T1078 (Valid Accounts)

• Execution: T1059 (Command and Scripting Interpreter)

• Persistence: T1542.001 (System Firmware), T1542.003 (Bootkit), T1543 (Create/Modify System Process)

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation)

• Defense Evasion: T1562 (Impair Defenses), T1070 (Indicator Removal)

• Impact: T1529 (System Shutdown/Reboot), T1499 (Endpoint DoS)

• Resource Development: T1588 (Obtain Capabilities), T1588.005 (Exploit), T1588.006 (Vulnerabilities)

References

• Cisco – ASA and FTD Continued Attacks

• Unit42 – Cisco Zero-Day Vulnerabilities Exploited

• Tenable – CVE-2025-20333 and CVE-2025-20362 FAQ

• Hive Pro – ArcaneDoor Espionage Campaign

• MITRE ATT&CK Techniques