---
title: "Security digest: September 25, 2025"
url: https://erroneo.us/security/2025-09-25/
description: "September 25, 2025 vulnerability digest: 1 brief (ArcaneDoor); 2 CISA KEV additions (Cisco); 2 critical advisories (npm, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-09-25
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 25, 2025

1 editorial brief, 2 known exploited (cisa kev) additions and 2 critical advisories.

## Take stock

- Patch this week: ArcaneDoor . Anyone running Cisco ASA or FTD with SSL VPN, AnyConnect IKEv2 client services or Mobile User Security enabled, and anyone still running ASA 5500-X hardware.
- Do you run any of these? Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-09-26.
- npm: 1 critical advisory ( cors-anywhere ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/gardener/gardener-extension-provider-aws , github.com/gardener/gardener-extension-provider-gcp , github.com/gardener/gardener-extension-provider-azure , github.com/gardener/gardener-extension-provider-openstack ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Patch this week** [Cisco ASA/FTD VPN Zero-Days Tied to ArcaneDoor](https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-cve-2025-20333-20362-arcanedoor/index.md): Still live in October 2026: the actor added a persistence mechanism in April 2026 that survives the September 2025 fixes, so ASA/FTD owners with VPN web services need the latest updates and a physical power cycle, not just last year's patch.

## Known exploited (CISA KEV)

- [CVE-2025-20362](https://erroneo.us/security/cve/CVE-2025-20362/index.md) Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability (CISA due 2025-09-26)
- [CVE-2025-20333](https://erroneo.us/security/cve/CVE-2025-20333/index.md) Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability (CISA due 2025-09-26)

## Critical advisories

- [CVE-2020-36851](https://erroneo.us/security/cve/CVE-2020-36851/index.md) cors-anywhere vulnerable to server-side request forgery — npm cors-anywhere <= 0.4.4 → no fix
- [CVE-2025-59823](https://erroneo.us/security/cve/CVE-2025-59823/index.md) Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning — Go github.com/gardener/gardener-extension-provider-aws < 1.64.0 → 1.64.0; Go github.com/gardener/gardener-extension-provider-gcp < 1.46.0 → 1.46.0; Go github.com/gardener/gardener-extension-provider-azure < 1.55.0 → 1.55.0

---
Source page: https://erroneo.us/security/2025-09-25/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt