Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks describe how two flaws in the VPN web server of ASA 5500-X series devices were exploited as zero-days in attacks linked to the ArcaneDoor espionage campaign. According to Cisco, the vulnerabilities—CVE-2025-20333 (CVSS 9.9) and CVE-2025-20362 (CVSS 6.5)—could allow remote code execution or unauthorised access, with one requiring authentication and the other not.

The issues arise from improper validation of user-supplied HTTP(S) input, enabling attackers to run arbitrary code with root privileges or reach restricted URLs without authentication; the company states the flaws were identified after-assisted investigations into attacks against government organisations targeting ASA VPN web services.

The attacks reportedly compromised 5512-X, 5515-X and 5585-X devices, and models 5525-X, 5545-X and 5555-X which will be discontinued on 30 September 2025, while ASA software on other models remains unaffected if Secure Boot is present. The arcane campaign is linked to ArcaneDoor with evidence suggesting China‑based actors, and UK entities such as the NCSC have published analysis of malware components RayInitiator and LINE VIPER to aid detection and mitigation.

CISA added both CVEs to its KEV catalog and issued ED 25-03, directing federal agencies to identify Cisco ASA and Firepower devices and conduct forensic analysis by the end of 26 September.