U.S. CISA adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Cisco, SonicWall and ASUS flaws to its Known Exploited Vulnerabilities (KEV) catalog, listing CVE-2025-20393 (Cisco Multiple Products Improper Input Validation, CVSS 10.0), CVE-2025-40602 (SonicWall SMA1000 Missing Authorization, CVSS 6.6) and CVE-2025-59374 (ASUS Live Update Embedded Malicious Code, CVSS 9.3).

According to Cisco Security Advisory, the December 10 campaign targeted certain Secure Email Gateway appliances with exposed ports, allowing threat actors to execute root-level commands and plant persistence; the exploit concerns a Remote Command Execution vulnerability tracked as CVE-2025-20393.

The SonicWall advisory describes a local privilege escalation due to insufficient authorization in the SMA1000 appliance management console (AMC), which has been chained with CVE-2025-23006 in zero‑day attacks to escalate privileges, though SonicWall notes its Firewall products are not affected.

CISA orders federal agencies to fix the CISCO and SonicWall vulnerabilities by 24 December 2025 and the ASUS flaw by 7 January 2025, in line with Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities. The ASUS issue stems from a supply chain compromise in which certain Live Update versions carried embedded malicious code, linked to the ShadowHammer campaign uncovered in 2019. Experts are urged to review the KEV Catalog and ensure remediation actions across appropriate infrastructures.