Cisco became aware of a new attack variant against Secure Firewall ASA and FTD devices

Cisco warned of a new attack variant targeting vulnerable Secure Firewall ASA and FTD devices by exploiting CVE-2025-20333 and CVE-2025-20362, in an alert published on 5 November 2025. According to Cisco, the attack can cause unpatched devices to unexpectedly reload, leading to denial of service unless customers upgrade to the fixed software releases listed in the alert.

The two vulnerabilities could be chained, and CVE-2025-20333 is a buffer overflow in Cisco Secure Firewall ASA/FTD VPN Web Server that can enable remote code execution, while CVE-2025-20362 is a missing authorization flaw in the same products. After fixes were released, the UK National Cyber Security Centre reported zero-day exploitation to deploy RayInitiator and LINE VIPER malware, marking a notable evolution in campaigns. Cisco also links the new activity to the ArcaneDoor threat actor, noting no evidence of compromise on other FTD or hardware platforms.