Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362

Cisco has disclosed a new attack variant targeting devices running Cisco Secure Firewall ASA and FTD software that are vulnerable to CVE-2025-20333 and CVE-2025-20362, with the warning coming in an updated advisory issued on Wednesday.

According to the advisory, unpatched devices can be forced to reload, creating denial-of-service conditions, and the vulnerabilities were previously disclosed in late September 2025 after being exploited as zero-days in attacks delivering RayInitiator and LINE VIPER, according to the U.K. National Cyber Security Centre. The exploitable flaws allow arbitrary code execution as root via crafted HTTP requests for CVE-2025-20333 and unauthenticated access to a restricted URL for CVE-2025-20362.

Cisco notes patches have been shipped for related issues in Unified CCX (two flaws, CVE-2025-20354 and CVE-2025-20358) and for a high-severity DoS flaw in Identity Services Engine (CVE-2025-20343), with specific fixes listed for Cisco Unified CCX releases 12.5 SU3 ES07 and 15.0 ES01. The company credited security researcher Jahmel Harris for discovering and reporting these shortcomings.

While there is no evidence of active exploitation for all three flaws, users are urged to apply updates promptly, and the overall advisory also references CVSS scores of 9.8 for CVE-2025-20354, 9.4 for CVE-2025-20358, and 8.6 for CVE-2025-20343.