Cisco patched two zero-days in ASA and FTD, CVE-2025-20333, CVE-2025-20362, that were exploited by the same threat actor behind the ArcaneDoor campaign, UAT4356

CVE-2025-20333, CVE-2025-20362: Cisco Zero-Days Exploited | Tenable®

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

CISA has released updated patch guidance and urges immediate patching for these Cisco vulnerabilities which have been exploited in the wild.

Exploitation has been observed in the wild. Patch as soon as possible.

Nearly 50k Cisco ASA/FTD devices remain vulnerable to two zero-day flaws exploited in the wild to deploy LINE VIPER and RayInitiator malware. Patch as soon as possible.

Zero-day vulnerability in Cisco ASA and FTD that was exploited in the wild by the same threat actor behind the ArcaneDoor campaign. Patch as soon as possible.

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability:

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco     Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary     code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S)     requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP     requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root,     possibly resulting in the complete compromise of the affected device. (CVE-2025-20333)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software is affected by a vulnerability:

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco     Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary     code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S)     requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP     requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root,     possibly resulting in the complete compromise of the affected device. (CVE-2025-20333)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

ID	Name	Product	Family	Severity
265943	Cisco Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution (cisco-sa-asaftd-webvpn-z5xP8EUB)	Nessus	CISCO	critical
265942	Cisco Secure Firewall Adaptive Security Appliance VPN Web Server Remote Code Execution (cisco-sa-asaftd-webvpn-z5xP8EUB)	Nessus	CISCO	critical

Detections

Analytics

CVE-2025-20333

critical

Tenable Plugins

critical

critical