Cisco ASA/FTD VPN Zero-Days Tied to ArcaneDoor

What to do

1. Inventory every ASA and FTD device and check show version and whether webvpn or crypto ikev2 client-services is enabled.
2. Upgrade to Cisco's current recommended release for your train via the Cisco Software Checker, including the 2026 persistence-specific update; migrate off trains with no fix (e.g. ASA 9.17, 9.19, FTD 7.1, 7.3).
3. After updating, hard-reset Firepower and Secure Firewall devices by physically removing power, as CISA ED 25-03 V1 requires; a reboot is not enough.
4. Retire ASA 5500-X hardware: the non-Secure-Boot models were compromised at the ROMMON level and 9.12/9.14 are final releases.
5. If compromise is suspected, keep the device powered on, isolate it, collect a core dump per CISA instructions, open a Cisco TAC case, and replace all passwords, certificates and keys after a factory reset.

How to check if you are affected or compromised

• After booting a fixed release on a 5500-X, check for firmware_update.log on disk0: (written when ROMMON persistence was found and removed) and send it to Cisco TAC.
• Follow CISA's Core Dump and Hunt Instructions and submit dumps via malware.cisa.gov.
• Watch for unexplained device reloads, disabled logging or gaps in syslog from firewalls running VPN web services.
• Enable Snort rules 65340 (CVE-2025-20333) and 46897 (CVE-2025-20362) where available.

What happened#

On September 25, 2025, Cisco disclosed two zero-days in the VPN web server of Secure Firewall ASA and FTD software. CVE-2025-20333 (CVSS 3.1 9.9) lets an attacker with valid VPN credentials execute arbitrary code as root using crafted HTTP(S) requests. CVE-2025-20362 (6.5) lets an unauthenticated attacker reach restricted VPN-related URL endpoints. Chained, the two give an unauthenticated attacker root. CISA describes the campaign as unauthenticated remote code execution. CISA added both CVEs to KEV that day. It also issued Emergency Directive 25-03, ordering federal agencies to collect core dumps from public-facing ASAs by September 26 and to disconnect end-of-support hardware by September 30.

According to Cisco's event page, government incident responders first contacted Cisco in May 2025 about attacks on ASA 5500-X devices running VPN web services. Cisco assesses with high confidence that the activity is linked to ArcaneDoor, the espionage campaign it exposed in early 2024. The attackers disabled logging, intercepted CLI commands, deliberately crashed devices, and modified ROMMON on older 5500-X models that lack Secure Boot, so their implant survived reboots and upgrades.

The story did not end there. On November 5, 2025, Cisco reported a new attack variant that crashes unpatched devices. In April 2026 Cisco said the actor had built a new persistence mechanism in the FXOS base OS that survives upgrades to the September 2025 fixed releases. Targeting had widened from 5500-X to any device running ASA or FTD. CISA updated ED 25-03 on April 23, 2026. The update added Firepower 1000/2100/4100/9300 and Secure Firewall 200-6100 series, and it required a persistence-specific patch plus a hard power reset.

Who is affected#

You are exposed if ASA or FTD has a VPN web service enabled: SSL VPN (webvpn with enable <interface>), AnyConnect IKEv2 client services (crypto ikev2 enable <interface> client-services), or, on ASA, Mobile User Security. Cisco Secure FMC is not affected. Example fixed builds from September 2025 are ASA 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14 and 9.23.1.19, and FTD 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1 and 7.7.10.1. ASA 5500-X on 9.12 or 9.14 got final special releases, 9.12.4.72 and 9.14.4.28. Trains such as ASA 9.17 and 9.19 and FTD 7.1 and 7.3 must migrate to a fixed release.

Do you really need to act?#

Yes, if you run ASA or FTD remote-access VPN. Most 2025 edge-device bugs now only call for verifying an old patch. This one is different. The April 2026 persistence mechanism means a device patched in September 2025 can still carry an implant. CISA treated that seriously enough to require federal agencies to physically unplug devices, because a reboot is not sufficient. Cisco lists no workaround for CVE-2025-20333. Disabling IKEv2 client services or webvpn is only a temporary mitigation. If your firewalls have no VPN web services, you face little direct risk, but you should still stay current.

What to do now#

1. Inventory every ASA and FTD. Record show version and whether webvpn or IKEv2 client-services is enabled.
2. Use the Cisco Software Checker to move to the current recommended release for your train, including the 2026 persistence update. Migrate trains that have no fix.
3. Hard-reset updated Firepower and Secure Firewall devices by removing power, matching CISA's ED 25-03 V1 requirement.
4. Replace ASA 5500-X hardware. The non-Secure-Boot models were the ones compromised at ROMMON level, and they have no future fixes.
5. If you suspect compromise, keep the device powered and isolated, collect a core dump per CISA's instructions, and engage Cisco TAC. Cisco says all configuration on a compromised device should be considered untrusted, so factory-reset it and replace passwords, certificates and keys.

How to tell if you were hit#

On a non-Secure-Boot 5500-X, booting a fixed release checks ROMMON. If it finds the persistence, it removes it and writes firmware_update.log to disk0:. If that file exists, open a TAC case with show tech-support. For other platforms, follow Cisco's Detection Guide and CISA's Core Dump and Hunt Instructions, and submit dumps through malware.cisa.gov. Treat unexplained reloads and sudden syslog gaps from VPN firewalls as leads. Snort rules 65340 and 46897 cover the two CVEs.

Timeline#

• May 2025 — Government responders engage Cisco about attacks on ASA 5500-X devices.
• Sep 25, 2025 — Cisco advisories and fixes published. CISA adds both CVEs to KEV and issues ED 25-03.
• Sep 30, 2025 — ED 25-03 deadline to disconnect end-of-support ASA hardware.
• Nov 5, 2025 — Cisco reports a new DoS attack variant against unpatched devices.
• Apr 23, 2026 — CISA updates ED 25-03 for FXOS persistence. Firepower and Secure Firewall series added to scope.
• Apr 30, 2026 — ED 25-03 V1 deadline for a physical hard reset.

Vulnerability records

• CVE-2025-20333 · KEV 2025-09-25 · A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD)…
• CVE-2025-20362 · KEV 2025-09-25 · Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Cisco — Cisco Secure Firewall ASA and FTD VPN Web Server Remote Code Execution Vulnerability (cisco-sa-asaftd-webvpn-z5xP8EUB) sec.cloudapps.cisco.com
2. Cisco — Continued Attacks Against Cisco Firewalls (event response) sec.cloudapps.cisco.com
3. CVE Program — CVE-2025-20362 record (Cisco CNA) cveawg.mitre.org
4. CISA — ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices cisa.gov