UK and US security agencies order urgent fixes as Cisco firewall bugs exploited in wild
- Reference: 1758882155
- News link: https://www.theregister.co.uk/2025/09/26/cisco_firewall_flaws/
- Source link:
The Cybersecurity and Infrastructure Security Agency (CISA) [1]issued an Emergency Directive on Thursday , saying there is "an unacceptable risk" to government systems if Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) devices are left unpatched. Federal agencies have been given just 24 hours to identify affected kit, check logs for compromise, and apply Cisco's fixes.
CISA also warned that any ASA boxes hitting end-of-life on September 30 shouldn't just be patched – they need to be yanked off networks for good.
[2]
The UK's National Cyber Security Centre has also [3]urged organizations to patch the vulnerabilities , tracked as CVE-2025-20333 and CVE-2025-20362, which are being abused to "implant malware, execute commands, and potentially exfiltrate data from compromised devices."
[4]
[5]
Cisco released patches for the flaws on Thursday, and warned that when chained together, they could let attackers remotely take complete control of devices.
The networking giant has also admitted that it knew these flaws were being exploited as far back as May, when government incident responders called it in to help investigate intrusions on ASA 5500-X firewalls. Attackers were already dropping implants, running commands, and siphoning data – a detail that makes the months-long delay in raising the wider alarm all the more uncomfortable.
[6]
Cisco assesses with "high confidence" that this wave of exploitation is tied to the ArcaneDoor campaign it reported last year. The company described the activity as "highly targeted," involving custom implants and persistence mechanisms designed to maintain long-term access.
[7]Zero-day deja vu as another Cisco IOS bug comes under attack
[8]US puts $10M bounty on three Russians accused of attacking critical infrastructure
[9]FBI: Russian spies exploiting a 7-year-old Cisco bug to slurp configs from critical infrastructure
[10]Cisco's Secure Firewall Management Center now not-so secure, springs a CVSS 10 RCE hole
ArcaneDoor first came to light in April 2024, when Cisco patched two zero-day flaws in ASA and FTD firewalls that had already been exploited to break into government and telecom networks. Cisco pinned the activity on a threat crew it dubbed UAT4356, which had been abusing the bugs [11]to compromise government systems worldwide since November 2023 .
"This actor utilized bespoke tooling that demonstrated a clear focus on espionage and an in-depth knowledge of the devices that they targeted," the company said, adding that the threat group has the "hallmarks of a sophisticated state-sponsored actor."
Security researchers reckon the fingerprints look familiar. By investigating the attacker-controlled IP addresses flagged by Cisco Talos and cross-checking them against certificate data, Censys [12]uncovered links to major Chinese networks and traces of homegrown anti-censorship software.
And if all that wasn't bad enough, the firewall fiasco lands barely 24 hours after [13]Cisco admitted yet another zero-day was being exploited in its IOS software . For customers, it's starting to look less like bad luck and more like a habit. ®
Get our [14]Tech Resources
[1] https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aNa4inZYk7aibscQ-Hg66QAAAgc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.ncsc.gov.uk/news/persistent-malicious-targeting-cisco-devices
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aNa4inZYk7aibscQ-Hg66QAAAgc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aNa4inZYk7aibscQ-Hg66QAAAgc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aNa4inZYk7aibscQ-Hg66QAAAgc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/09/25/zeroday_deja_vu_another_cisco/
[8] https://www.theregister.com/2025/09/04/us_10m_bounty_fsb_attackers/
[9] https://www.theregister.com/2025/08/20/russian_fsb_cyberspies_exploiting_cisco_bug/
[10] https://www.theregister.com/2025/08/15/cisco_secure_firewall_management_bug/
[11] https://www.theregister.com/2024/04/24/spies_cisco_firewall/
[12] https://censys.com/blog/analysis-of-arcanedoor-threat-infrastructure-suggests-potential-ties-to-chinese-based-actor
[13] https://www.theregister.com/2025/09/25/zeroday_deja_vu_another_cisco/
[14] https://whitepapers.theregister.com/
Meanwhile @Cisco
CEO: Hello CFO, how about our bonus for this year?
CFO: There have been some extra expenses in the software division. It may be necessary to limit our expenses.
CTO: Oh, no problem. There are some very expensive senior staff that should be replaced with that new thingy, whatayoucallit, vibe something. It is much cheaper and allows us to reallocate funds to where it matters.
CEO: How many shall we get rid of? 10%?, 20%?
CFO: I'd say 30% need to go for our bonus targets to be met.
CTO: No problem!
CEO: Hello HR, please fire 30% of our most expensive slaves in the software division.
HR: Sure about that?
CEO, CFO, CTO: Yes.
HR: OK.
CEO, CFO, CTO:
Re: Meanwhile @Cisco
CEO, CFO, CTO: Payday
Probably true. However don't forget the CEO/Board are responsible for delivering value to the shareholders and needing to meet the analyst's forecasts. That's another form of pressure the C-suite are under.
It's déjà vu all over again, Yogi
CVE-2025-20333 is a critical buffer overflow vulnerability .. is caused by improper validation of user-supplied input in HTTP(S) requests to the web service, exposing vulnerable Cisco firewall systems to the threat of arbitrary code execution with root privileges.
Censys
>> Censys uncovered links to major Chinese networks
Does Censys ever uncover links to major US networks? Or is it blind in that direction? If it is blind then it can't be trusted.
If the UK was serious about network security it would banish Cisco once and for all. The number of backdoors, mysteriously forgotten hard-coded passwords, unusual packet overflows that keep being found in Cisco equipment somehow gets a free pass. Over and over and over and over.
Or is it a case of "we knew about it all along and have been exploiting it, but now it's known publicly we don't want anyone else to use it"?
Hmmm...
...wasn't Chinese spying and horrible security the reason everybody was pressured into getting rid of their Heaiwai, Haeawa... oh however the hell you spell it, it was deemed bad bad bad...
...and yet, this stuff is just the same only different. Maybe we ought to blacklist Cisco too?
Re: Hmmm...
The difference was was Huawei was very capable kit at a "low" made by the Chinese that had piss poor security, whereas Cisco is fairy capable kit, at a high price, made in the USA that has piss poor security.
"The networking giant has also admitted that it knew these flaws were being exploited as far back as May, when government incident responders called it in to help investigate intrusions on ASA 5500-X firewalls. Attackers were already dropping implants, running commands, and siphoning data"
Which government out of curiosity, the article doesn't make that clear. The cynic in me says whichever government it was, wanted to use it themselves for while before raising any flags.
Regardless, 4 months between spotting an exploit actively in use in the wild and patching is damming for Cisco. Given their gear is used by a lot of agencies, you would hope a swift foot up the rear-end is winging it's way to Cisco.
But if you don't want to use Cisco, who else is there? Palo Alta? Fortinet? Juniper?
Personally in order of speed for patching I'd rank them in order of Juniper, Palo Alta, Fortinet then Cisco, but that just my own personal back of an envelope opinion.
>> who else is there
Huawei. They have had their source code reviewed. Unlike Cisco.
Unbelievable!
Cisco has a long history of producing network gear where security is an important feature, so why haven't their code writing and QA processes evolved to avoid and/or detect security bugs before the product is released?