erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: September 25, 2025

1 editorial brief, 2 known exploited (cisa kev) additions and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Patch this week: ArcaneDoor. Anyone running Cisco ASA or FTD with SSL VPN, AnyConnect IKEv2 client services or Mobile User Security enabled, and anyone still running ASA 5500-X hardware.
  • Do you run any of these? Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-09-26.
  • npm: 1 critical advisory (cors-anywhere). Check with npm audit (or: npm ls <package>).
  • Go: 1 critical advisory (github.com/gardener/gardener-extension-provider-aws, github.com/gardener/gardener-extension-provider-gcp, github.com/gardener/gardener-extension-provider-azure, github.com/gardener/gardener-extension-provider-openstack). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2025-20333, CVE-2025-20362

Cisco ASA/FTD VPN Zero-Days Tied to ArcaneDoor

Still live in October 2026: the actor added a persistence mechanism in April 2026 that survives the September 2025 fixes, so ASA/FTD owners with VPN web services need the latest updates and a physical power cycle, not just last year's patch.

Must act: Anyone running Cisco ASA or FTD with SSL VPN, AnyConnect IKEv2 client services or Mobile User Security enabled, and anyone still running ASA 5500-X hardware.

Can relax: Sites whose ASA/FTD devices have no VPN web services enabled, and Cisco Secure FMC itself, which is not affected; they should still stay current.

  1. Inventory every ASA and FTD device and check show version and whether webvpn or crypto ikev2 client-services is enabled.
  2. Upgrade to Cisco's current recommended release for your train via the Cisco Software Checker, including the 2026 persistence-specific update; migrate off trains with no fix (e.g. ASA 9.17, 9.19, FTD 7.1, 7.3).
  3. After updating, hard-reset Firepower and Secure Firewall devices by physically removing power, as CISA ED 25-03 V1 requires; a reboot is not enough.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-20362Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability		2025-09-26
CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability		2025-09-26

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 1

Check: govulncheck ./...

npm 1

Check: npm audit (or: npm ls <package>)