Executive Summary

On November 5, 2025, Cisco released an updated advisory warning of a new, active attack campaign targeting its Cisco Secure Firewall ASA and Secure Firewall FTD software. The attack leverages a chain of two vulnerabilities, CVE-2025-20333 and CVE-2025-20362, to trigger an unexpected reload of the device, resulting in a denial-of-service (DoS) condition. These vulnerabilities are not new; they were patched in September 2025 after being actively exploited as zero-days and were subsequently added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The emergence of this new attack variant underscores the continued risk posed by these flaws to unpatched devices. Cisco is urging all customers to apply the necessary security updates without delay to mitigate the risk of network disruption.

Vulnerability Details

The new attack variant chains two distinct vulnerabilities to achieve its effect:

• CVE-2025-20333: A buffer overflow vulnerability in the firewall's remote access VPN feature. While the current attack variant uses it for a DoS, a buffer overflow could potentially be leveraged for remote code execution (RCE) by a skilled attacker.
• CVE-2025-20362: A missing authorization vulnerability that allows an unauthenticated, remote attacker to access restricted URLs on the device. This flaw likely serves as the entry point to reach the vulnerable code path for CVE-2025-20333.

By chaining these two flaws, an attacker can send a specially crafted request to an unpatched firewall, causing the system to crash and reload, thereby denying service to all traffic passing through it.

Affected Systems

The vulnerabilities affect the following Cisco products running vulnerable software versions:

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Secure Firewall Threat Defense (FTD) Software

Customers should consult the official Cisco advisory for a complete list of affected versions and the corresponding fixed software releases.

Exploitation Status

These vulnerabilities are being actively exploited in the wild. They have a history of exploitation, having been used as zero-days in September 2025 by sophisticated actors to deliver malware such as RayInitiator and LINE VIPER, according to the UK's NCSC. Their inclusion in the CISA KEV catalog highlights their proven risk. This new DoS attack variant demonstrates that multiple threat actors are now weaponizing these flaws, increasing the likelihood of attacks against any organization with unpatched devices.

Impact Assessment

• Denial-of-Service (DoS): The immediate and confirmed impact is a DoS condition. As firewalls are typically in-line devices that control all network traffic, a crash can lead to a complete network outage for an organization, disrupting all business operations.
• Potential for Remote Code Execution: While the current campaign is focused on DoS, the underlying buffer overflow vulnerability (CVE-2025-20333) suggests that RCE may be possible. A successful RCE attack on a perimeter firewall would be catastrophic, giving an attacker a powerful foothold on the edge of the network.
• Reputational Damage: Network outages can damage an organization's reputation and violate service-level agreements (SLAs) with customers.

Cyber Observables for Detection

Detection Methods

1. Vulnerability Scanning: Use a vulnerability scanner with up-to-date plugins to actively scan for Cisco ASA/FTD devices in your environment and identify those running vulnerable software versions.
2. Log Monitoring: Configure all Cisco firewall devices to send logs to a central SIEM. Create alerting rules for unexpected device reloads and for access attempts to known-vulnerable URL paths.
3. Intrusion Detection/Prevention Systems (IDS/IPS): Ensure your IDS/IPS has the latest signatures from Cisco or third-party vendors to detect and potentially block exploit attempts targeting CVE-2025-20333 and CVE-2025-20362. This aligns with D3-ITF: Inbound Traffic Filtering.

Remediation Steps

1. Upgrade Software: The most critical step is to upgrade all vulnerable Cisco Secure Firewall ASA and FTD devices to a fixed software release as recommended in the Cisco security advisory. This is the only way to fully remediate the vulnerabilities. This is a direct application of D3-SU: Software Update.
2. Restrict Access: As a temporary mitigation, restrict access to the firewall's management interface and any remote access VPN services to only trusted IP addresses. This reduces the attack surface but does not eliminate the vulnerability.
3. Verify Upgrade: After applying the patches, verify that the devices are running the correct, non-vulnerable software version and monitor them for stability.