CISA Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices

According to CISA Emergency Directive 25-03, there is an ongoing exploitation campaign by an advanced threat actor targeting Cisco ASA devices, with attackers exploiting zero-day vulnerabilities to gain unauthenticated remote code execution and to manipulate ROM to persist through reboot and system upgrade.

The campaign is described as widespread and presents a significant risk to victim networks; CISA notes that it is connected to ArcaneDoor activity identified in early 2024 and that the threat actor has demonstrated a capability to modify ASA ROM at least as early as 2024. The zero-day vulnerabilities affecting the Cisco ASA platform are also present in certain versions of Cisco Firepower, and Firepower appliances’ Secure Boot would detect the ROM manipulation.

CISA has assessed that CVE-2025-20333 and CVE-2025-20362 pose an unacceptable risk to federal information systems, with remote code execution and privilege escalation respectively, and directs agencies to address these immediately through the actions outlined in the Directive. Agencies are instructed to account for all Cisco ASA and Firepower devices, collect forensics and assess compromise via CISA-provided procedures and tools, disconnect end-of-support devices, and upgrade devices that will remain in service. The page was posted on 26 September 2025.