{"id":5051,"date":"2025-09-25T21:15:43","date_gmt":"2025-09-25T21:15:43","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=5051"},"modified":"2025-09-25T21:15:43","modified_gmt":"2025-09-25T21:15:43","slug":"patch-now-attacker-finds-another-zero-day-in-cisco-firewall-software","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=5051","title":{"rendered":"Patch now: Attacker finds another zero day in Cisco firewall software"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A critical zero-day vulnerability in certain Cisco Systems firewalls has to be patched immediately, US and UK cyber authorities warned Thursday.<\/p>\n

They said exploits of the hole are part of ongoing attacks on these and other network perimeter devices.<\/p>\n

The UK\u2019s National Cyber Security Centre (NCSC) called the alert<\/a> from Cisco a \u201csignificant update\u201d on a malicious campaign against perimeter network devices which was exposed last year<\/a> and dubbed ArcaneDoor. And the US Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive<\/a> ordering federal departments to identify, analyze, and mitigate potential compromises.<\/p>\n

The new vulnerability, CVE-2025-20363, is caused by improper validation of user-supplied input in HTTP requests, Cisco said<\/a>.<\/p>\n

An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device, after obtaining additional information about the system, overcoming exploit mitigations, or both.<\/p>\n

A successful exploit could allow the attacker to execute arbitrary code as\u00a0root<\/em>, which may lead to the complete compromise of the device.<\/p>\n

Affected are devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) software, Cisco Secure Firewall Threat Defense (FTD) software, as well as devices running Cisco IOS, IOS XE and IOS XR software.<\/p>\n

Two scenarios<\/h2>\n

There are two attack scenarios:<\/p>\n

an unauthenticated, remote attacker getting into devices running Cisco ASA and FTD software with one or more vulnerable configurations could execute arbitrary code;<\/p>\n

an authenticated, remote attacker getting into devices running Cisco IOS, IOS XE or IOS XR with low user privileges could execute arbitrary code on an affected Cisco device. However, note that devices running IOS or IOS XE are only affected if they have the Remote Access SSL VPN feature enabled. Devices running IOS XR are only affected if they are running on Cisco ASR 9001 routers with the HTTP server enabled.<\/p>\n

Cisco has released software updates that address this vulnerability, and strongly recommends that customers quickly upgrade to a fixed software release. There are no workarounds that address this issue.<\/p>\n

\u201cIt is critical for organizations to take note of the recommended actions highlighted by Cisco today, particularly on detection and remediation,\u201d said Ollie Whitehouse<\/a>, chief technology officer of the UK cyber center. \u00a0\u201cWe strongly encourage network defenders to follow vendor best practices and engage with the NCSC\u2019s malware analysis report to assist with their investigations.\u201d<\/p>\n

ASA 5500-X hit with multiple attacks<\/h2>\n

Cisco ASA 5500-X series models are affected, but Whitehouse noted some will be out of support starting this month. Where practicable, he said, such devices should be replaced or upgraded, because obsolete and end-of-life devices present a significant security risk to organizations.<\/p>\n

\u201cSystems and devices should be promptly migrated to modern versions to address vulnerabilities and strengthen resilience,\u201d he said.<\/p>\n

In fact, Cisco also said Thursday that it had found new activity specifically targeting the ASA 5500-X<\/a> series with two new vulnerabilities: CVE-2025-20333, CVE-2025-20362, as well as with CVE-2025-20363.<\/p>\n

In a background report outlining its response to attacks<\/a>, the company said that during its forensic analysis of confirmed compromised devices, it found that sometimes the threat actor modified the ROMMON firmware on Cisco devices. This firmware acts as a low-level bootloader and recovery tool that initializes hardware and loads the main operating system. Altering it allows the threat actor to maintain persistence across reboots and software upgrades.<\/p>\n

However, Cisco added, these modifications were seen only on ASA 5500-X Series platforms that were released prior to the development of Secure Boot<\/a> and Trust Anchor<\/a> technologies. Cisco has not seen successful compromise, malware implantation, or the existence of a persistence mechanism on platforms that support Secure Boot and Trust Anchors.<\/p>\n

Take devices offline until patched: Analyst<\/h2>\n

A large probing attack against Cisco devices was reported in August, noted Robert Beggs<\/a>, head of Canadian incident response firm DigitalDefence. At the time, he said, it was suggested that this would be a prelude to a widespread vulnerability exploitation.\u00a0\u201cIn this case, at least, the Cisco vulnerability was expected,\u201d he said.\u00a0\u201cThe detection of wide-scale probing of devices\u00a0appears to be a reliable predictor of a following attack.\u201d<\/p>\n

Because the vulnerabilities at the root of the attack can both be remotely exploited, affected devices should be taken offline until the patch is applied and verified to be in place, Beggs recommended.<\/p>\n

It\u2019s telling \u201cand somewhat startling,\u201d he added, that the CISA directive asks US federal agencies to supply memory files for forensic analysis on a \u201cnear immediate\u201d timeline for all public-facing Cisco ASA hardware appliances.<\/p>\n

Thursday\u2019s warning of critical vulnerabilities in Cisco products follows other recent alerts<\/a>, he said, pointing out that there have been several other critical vulnerabilities<\/a> identified in Cisco products this summer. These are good arguments for CSOs to implement a zero trust architecture<\/a>, he said, especially for monitoring sources for and applying updates on products in accordance with the risk they present to your organization.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A critical zero-day vulnerability in certain Cisco Systems firewalls has to be patched immediately, US and UK cyber authorities warned Thursday. They said exploits of the hole are part of ongoing attacks on these and other network perimeter devices. The UK\u2019s National Cyber Security Centre (NCSC) called the alert from Cisco a \u201csignificant update\u201d on […]<\/p>\n","protected":false},"author":0,"featured_media":5052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-5051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/5051"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5051"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/5051\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/5052"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}