Skip to content
All posts

· by NetProtector Security Team

Cisco: Zero-Days in the VPN Portal Open ASA Firewalls to Attackers

Illustration: Two chained links open a firewall's VPN portal, while malicious code embeds itself in ROM memory

A firewall's VPN portal is supposed to let in only authorized users. On Cisco's Secure Firewall ASA and Firepower Threat Defense (FTD), it could be bypassed via two zero-day vulnerabilities: CVE-2025-20362 opens protected areas of the VPN web server without authentication, and CVE-2025-20333 then allows malicious code to be executed there with root privileges. According to Cisco, chaining the two gives an attacker without credentials full control of the device. Cisco disclosed the vulnerabilities on September 25, 2025, and the US agency CISA issued Emergency Directive ED 25-03 on the same day. There is no workaround – only the update or disabling the VPN web services.

What it is about

The VPN web server is the part of the firewall through which employees log in remotely via AnyConnect or Secure Client. The first vulnerability, CVE-2025-20362, is a missing authorization check: crafted HTTPS requests reach URL endpoints that should only be accessible after login. The second, CVE-2025-20333, is a buffer overflow that normally requires valid VPN credentials. It is precisely this hurdle that the first vulnerability removes.

Key facts according to the Cisco advisories of September 25, 2025:

  • Severity: CVE-2025-20333 with CVSS 9.9 (“Critical”), CVE-2025-20362 with CVSS 6.5 (“Medium”). The medium score is misleading: only the combination makes the unauthenticated attack possible.
  • Affected: ASA and FTD software when VPN web services are enabled – SSL VPN (webvpn), AnyConnect IKEv2 remote access with client services and, for ASA, additionally Mobile User Security.
  • Fixed in: depending on the release train; for both vulnerabilities, for example, ASA 9.18.4.67, 9.20.4.10, 9.22.2.14 and 9.23.1.19 as well as FTD 7.2.10.2, 7.4.2.4, 7.6.2.1 and 7.7.10.1. Cisco's Software Checker provides information for your own version.
  • Prerequisite for the attack: a VPN web service reachable from the internet – which is exactly what a VPN portal is for.
  • Consequence: code execution as root and thus complete takeover of the firewall.

On the same day, Cisco disclosed a third vulnerability, CVE-2025-20363 (CVSS 9.0), which affects IOS, IOS XE and IOS XR in addition to ASA and FTD. At the time of disclosure, there were no indications that it had been exploited.

Why this is urgent

The attacks are not the work of an opportunistic attacker. According to Cisco, several government agencies engaged the company as early as May 2025 to investigate attacks on ASA 5500-X series devices. The company attributes the activity “with high confidence” to the same actor as the ArcaneDoor espionage campaign that Cisco reported on in early 2024. The attackers disabled logging, intercepted CLI commands and deliberately crashed devices to prevent analysis.

The compromised devices were older models without Secure Boot (5512-X, 5515-X, 5525-X, 5545-X, 5555-X and 5585-X). On these, the attackers modified the ROM Monitor to survive reboots and updates. The UK's NCSC has analyzed the malware used: the bootkit RayInitiator and the loader LINE VIPER, which can execute commands, capture network traffic and suppress syslog messages. LINE VIPER is controlled, among other things, via WebVPN login sessions – that is, via the same portal through which the intrusion occurred. On newer platforms with Secure Boot, Cisco has not observed any successful compromise.

CISA's response was unusually strict: US federal agencies had to inventory all ASA and Firepower devices, submit memory dumps for forensic analysis by September 26, disconnect devices no longer supported by the vendor by September 30, and update the remaining devices immediately. The attack surface is large: at the end of September, the Shadowserver Foundation counted nearly 50,000 vulnerable devices reachable from the internet, according to Cybersecurity Dive – with Germany among the five countries with the most hits.

What you should do now

  1. Take inventory. Determine which ASA and FTD devices you operate, which software version they run and whether VPN web services (SSL VPN or IKEv2 with client services) are enabled.
  2. Update. Install the fix specified for your release train. According to Cisco, the update also checks the ROM Monitor of affected devices at startup and removes the known persistence mechanism.
  3. Replace old hardware. ASA 5500-X models without Secure Boot have reached or are approaching the end of support. The NCSC recommends replacing them wherever possible.
  4. Disable as an interim measure if the update is not immediately possible: Cisco names disabling all SSL/TLS-based VPN web services as a temporary measure. However, this interrupts remote access via these services.
  5. Check for compromise. Cisco and the NCSC have published detection guidance and rules. If compromise is suspected, do not power off the device; instead, disconnect it from the network, treat the entire configuration as untrusted and renew all passwords, certificates and keys – ideally together with Cisco Support.

What this means for firewall protection

This case shows how much depends on a single device. The firewall is meant to protect the network, but its VPN portal must be reachable from the internet to do so – and thus becomes a target itself. In this case, Cisco had been investigating the attacks since May, and the patches arrived in September. And even after disclosure, it takes time until every device has been updated.

NetProtector therefore takes effect upstream. The appliance operates inline in front of the firewall and inspects traffic before it reaches the VPN portal:

  • Known attacker infrastructure is locked out. Scans for reachable VPN portals and widespread attack attempts often originate from addresses that the NetProtector sensor network has already observed elsewhere. Such sources are blocked before they can even reach your firewall.
  • Anomalies are detected. Systematic probing for device types and versions, brute-force login attempts or unusually frequent connections to the VPN service stand out in the data stream – patterns that often precede targeted attacks.
  • Buy time until the update. NetProtector does not replace the patch and does not detect every targeted exploit. However, it reduces the number of attackers that reach the vulnerable portal at all – especially in the phase when a vulnerability is known but not yet closed everywhere.
When is an attack detected?
1
Reconnaissance
Scans, scouting for targets
2
Preparation
Tools and access
3
Attack
Exploiting a vulnerability
4
Spread
Lateral movement in the network
5
Impact
Data theft, encryption
Traditional
pattern-based, reactive
NetProtector
anomaly-based, proactive
Traditional: Detection only once a known attack pattern appears – by then the attacker already knows the target.
NetProtector: Detection from the anomalies of reconnaissance – the source is blocked before the attack begins.

How NetProtector detects attacker infrastructure and is deployed between router and firewall without restructuring your network is explained on the page How NetProtector works.

Our assessment

Cisco worked with government agencies for months on the investigation and disclosed the vulnerabilities jointly with CISA and the NCSC – that is the right way to handle such a case. The lesson extends beyond a single vendor: VPN portals are a lucrative target, including for state-sponsored attackers, and devices without current protection mechanisms such as Secure Boot are particularly difficult to defend. Security for remote access therefore requires multiple layers: prompt updates, timely hardware replacement, monitored logins – and an upstream layer that keeps known attackers away before they reach the firewall.

Sources