--- title: "Cisco ASA/FTD VPN Zero-Days Tied to ArcaneDoor" url: https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-cve-2025-20333-20362-arcanedoor/ description: "CVE-2025-20333 + CVE-2025-20362 chain to root on Cisco ASA/FTD VPN web servers; exploited, CISA ED 25-03. 2026 persistence update: re-patch and power-cycle." type: security-brief section: "Security Digest" date_published: 2025-09-25 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Patch this week" cves: ["CVE-2025-20333", "CVE-2025-20362"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Cisco ASA/FTD VPN Zero-Days Tied to ArcaneDoor **Verdict: Patch this week.** Still live in October 2026: the actor added a persistence mechanism in April 2026 that survives the September 2025 fixes, so ASA/FTD owners with VPN web services need the latest updates and a physical power cycle, not just last year's patch. - **Who must act:** Anyone running Cisco ASA or FTD with SSL VPN, AnyConnect IKEv2 client services or Mobile User Security enabled, and anyone still running ASA 5500-X hardware. - **Who can relax:** Sites whose ASA/FTD devices have no VPN web services enabled, and Cisco Secure FMC itself, which is not affected; they should still stay current. - **Affected:** Cisco ASA Software with SSL VPN, AnyConnect IKEv2 client services or MUS enabled, releases before the fixed builds; Cisco FTD Software with remote access VPN (SSL or IKEv2 client services), releases before the fixed builds - **Fixed:** ASA 9.12.4.72 and 9.14.4.28 (final, 5500-X only); ASA 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19; FTD 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1; Plus later persistence-specific updates referenced by CISA in April 2026 - **CVEs:** CVE-2025-20333, CVE-2025-20362 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory every ASA and FTD device and check show version and whether webvpn or crypto ikev2 client-services is enabled. 2. Upgrade to Cisco's current recommended release for your train via the Cisco Software Checker, including the 2026 persistence-specific update; migrate off trains with no fix (e.g. ASA 9.17, 9.19, FTD 7.1, 7.3). 3. After updating, hard-reset Firepower and Secure Firewall devices by physically removing power, as CISA ED 25-03 V1 requires; a reboot is not enough. 4. Retire ASA 5500-X hardware: the non-Secure-Boot models were compromised at the ROMMON level and 9.12/9.14 are final releases. 5. If compromise is suspected, keep the device powered on, isolate it, collect a core dump per CISA instructions, open a Cisco TAC case, and replace all passwords, certificates and keys after a factory reset. ### How to check if you are affected - After booting a fixed release on a 5500-X, check for firmware_update.log on disk0: (written when ROMMON persistence was found and removed) and send it to Cisco TAC. - Follow CISA's Core Dump and Hunt Instructions and submit dumps via malware.cisa.gov. - Watch for unexplained device reloads, disabled logging or gaps in syslog from firewalls running VPN web services. - Enable Snort rules 65340 (CVE-2025-20333) and 46897 (CVE-2025-20362) where available. ## What happened On September 25, 2025, Cisco disclosed two zero-days in the VPN web server of Secure Firewall ASA and FTD software. [CVE-2025-20333](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB) (CVSS 3.1 9.9) lets an attacker with valid VPN credentials execute arbitrary code as root using crafted HTTP(S) requests. [CVE-2025-20362](https://cveawg.mitre.org/api/cve/CVE-2025-20362) (6.5) lets an unauthenticated attacker reach restricted VPN-related URL endpoints. Chained, the two give an unauthenticated attacker root. CISA describes the campaign as unauthenticated remote code execution. CISA added both CVEs to KEV that day. It also issued [Emergency Directive 25-03](https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices), ordering federal agencies to collect core dumps from public-facing ASAs by September 26 and to disconnect end-of-support hardware by September 30. According to [Cisco's event page](https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks), government incident responders first contacted Cisco in May 2025 about attacks on ASA 5500-X devices running VPN web services. Cisco assesses with high confidence that the activity is linked to ArcaneDoor, the espionage campaign it exposed in early 2024. The attackers disabled logging, intercepted CLI commands, deliberately crashed devices, and modified ROMMON on older 5500-X models that lack Secure Boot, so their implant survived reboots and upgrades. The story did not end there. On November 5, 2025, Cisco reported a new attack variant that crashes unpatched devices. In April 2026 Cisco said the actor had built a new persistence mechanism in the FXOS base OS that **survives upgrades to the September 2025 fixed releases**. Targeting had widened from 5500-X to any device running ASA or FTD. CISA updated ED 25-03 on April 23, 2026. The update added Firepower 1000/2100/4100/9300 and Secure Firewall 200-6100 series, and it required a persistence-specific patch plus a hard power reset. ## Who is affected You are exposed if ASA or FTD has a VPN web service enabled: SSL VPN (`webvpn` with `enable `), AnyConnect IKEv2 client services (`crypto ikev2 enable client-services`), or, on ASA, Mobile User Security. Cisco Secure FMC is not affected. Example fixed builds from September 2025 are ASA 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14 and 9.23.1.19, and FTD 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1 and 7.7.10.1. ASA 5500-X on 9.12 or 9.14 got final special releases, 9.12.4.72 and 9.14.4.28. Trains such as ASA 9.17 and 9.19 and FTD 7.1 and 7.3 must migrate to a fixed release. ## Do you really need to act? Yes, if you run ASA or FTD remote-access VPN. Most 2025 edge-device bugs now only call for verifying an old patch. This one is different. The April 2026 persistence mechanism means a device patched in September 2025 can still carry an implant. CISA treated that seriously enough to require federal agencies to physically unplug devices, because a reboot is not sufficient. Cisco lists no workaround for CVE-2025-20333. Disabling IKEv2 client services or `webvpn` is only a temporary mitigation. If your firewalls have no VPN web services, you face little direct risk, but you should still stay current. ## What to do now 1. Inventory every ASA and FTD. Record `show version` and whether `webvpn` or IKEv2 `client-services` is enabled. 2. Use the Cisco Software Checker to move to the current recommended release for your train, including the 2026 persistence update. Migrate trains that have no fix. 3. Hard-reset updated Firepower and Secure Firewall devices by removing power, matching CISA's ED 25-03 V1 requirement. 4. Replace ASA 5500-X hardware. The non-Secure-Boot models were the ones compromised at ROMMON level, and they have no future fixes. 5. If you suspect compromise, keep the device powered and isolated, collect a core dump per CISA's instructions, and engage Cisco TAC. Cisco says all configuration on a compromised device should be considered untrusted, so factory-reset it and replace passwords, certificates and keys. ## How to tell if you were hit On a non-Secure-Boot 5500-X, booting a fixed release checks ROMMON. If it finds the persistence, it removes it and writes `firmware_update.log` to `disk0:`. If that file exists, open a TAC case with `show tech-support`. For other platforms, follow Cisco's Detection Guide and CISA's Core Dump and Hunt Instructions, and submit dumps through malware.cisa.gov. Treat unexplained reloads and sudden syslog gaps from VPN firewalls as leads. Snort rules 65340 and 46897 cover the two CVEs. ## Timeline - May 2025 — Government responders engage Cisco about attacks on ASA 5500-X devices. - Sep 25, 2025 — Cisco advisories and fixes published. CISA adds both CVEs to KEV and issues ED 25-03. - Sep 30, 2025 — ED 25-03 deadline to disconnect end-of-support ASA hardware. - Nov 5, 2025 — Cisco reports a new DoS attack variant against unpatched devices. - Apr 23, 2026 — CISA updates ED 25-03 for FXOS persistence. Firepower and Secure Firewall series added to scope. - Apr 30, 2026 — ED 25-03 V1 deadline for a physical hard reset. ## Sources 1. [Cisco — Cisco Secure Firewall ASA and FTD VPN Web Server Remote Code Execution Vulnerability (cisco-sa-asaftd-webvpn-z5xP8EUB)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB) 2. [Cisco — Continued Attacks Against Cisco Firewalls (event response)](https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks) 3. [CVE Program — CVE-2025-20362 record (Cisco CNA)](https://cveawg.mitre.org/api/cve/CVE-2025-20362) 4. [CISA — ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices](https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices) --- Source page: https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-cve-2025-20333-20362-arcanedoor/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt