CISA Updates Guidance on Patching Cisco Devices Targeted in China-Linked Attacks

CISA has issued updated guidance on patching Cisco Secure Firewall ASA and Firepower devices exploited in the China-linked ArcaneDoor espionage campaign, noting that the two bugs, CVE-2025-20333 and CVE-2025-20362, were discovered in May after being exploited as zero-days. According to CISA, the vulnerabilities affect the VPN web server of ASA and FTD software and could allow attackers to execute arbitrary code with root privileges or access a restricted URL without authentication.

Cisco patched the defects on 25 September, and a new variant of the attack warned on 6 November that could cause devices to reload and experience DoS. ED 25-03 urged agencies to identify Cisco devices running vulnerable ASA and FTD versions and immediately apply the patches, with a requirement to report a complete inventory by 2 October.

Because some agencies could not locate the latest software iterations, CISA has published a list of minimum versions containing the fixes and fresh guidance on mitigation, urging agencies with updated devices to follow the guidance.