Summary Points
- Cisco warns of two actively exploited vulnerabilities (CVE-2025-20362 and CVE-2025-20333) in ASA and FTD firewalls, which, when chained, allow complete remote control of unpatched systems.
- The U.S. government, through CISA, urgently instructed federal agencies to secure affected devices within 24 hours and disconnect out-of-support firewalls.
- Over 34,000 vulnerable Cisco ASA/FTD firewalls are exposed online, with the attacks linked to a state-sponsored group behind the ArcaneDoor campaign, which exploited similar zero-day flaws.
- Cisco has released multiple patches for critical vulnerabilities and urges all users to update software immediately to prevent DoS attacks, unauthorized access, and malware deployment.
Key Challenge
Recently, Cisco revealed that two critical security vulnerabilities, CVE-2025-20362 and CVE-2025-20333, in its ASA and FTD firewalls are actively being exploited in targeted zero-day attacks. These flaws allow remote, unauthenticated hackers to hijack vulnerable devices, potentially gaining complete control over unpatched firewalls. In response, Cisco issued urgent security patches on September 25, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) swiftly mandated federal agencies to patch or disconnect affected devices within 24 hours to prevent widespread damage. Threat monitoring organizations like Shadowserver indicate that over 34,000 internet-facing firewalls remain vulnerable, and recent attacks have been causing devices to unexpectedly reboot, resulting in denial-of-service conditions. These incidents are linked to the notorious ArcaneDoor campaign, attributed to a state-sponsored group known as UAT4356 or STORM-1849, which has previously exploited similar vulnerabilities to infiltrate government networks globally. The researchers and cybersecurity authorities reporting these events emphasize the urgency of applying available updates to safeguard critical infrastructure from further breaches and disruptions.
What’s at Stake?
The issue of “Actively exploited firewall flaws now abused for DoS attacks” presents a serious threat to your business by exposing vulnerabilities that cybercriminals are currently exploiting to overwhelm your network, causing widespread service outages and disrupting operations. When hackers leverage these unpatched or overlooked firewall weaknesses, they can flood your systems with excessive traffic, rendering critical services inaccessible to clients and employees alike, which leads to lost revenue, damaged reputation, and potential data breaches. Without prompt detection and remediation, such attacks can spiral, causing significant financial harm and eroding customer trust—making it crucial for any organization to continually update and secure their firewall defenses to prevent these targeted, high-impact disruptions.
Possible Actions
Rapid Response
Addressing actively exploited firewall flaws promptly is crucial to prevent severe disruptions and maintain organizational security integrity, especially since attackers frequently capitalize on these vulnerabilities to launch Denial of Service (DoS) attacks, which can cripple essential network services and compromise data protection.
Mitigation Steps
-
Update Firmware
Apply the latest patches and firmware updates for firewalls to close known vulnerabilities that are being exploited. -
Implement Rule Refinements
Review and tighten firewall rules to restrict unnecessary traffic, especially from suspicious sources identified in threat intelligence. -
Enable Intrusion Prevention
Activate or strengthen intrusion prevention systems (IPS) to detect and block attack attempts exploiting firewall flaws. -
Monitor Traffic Patterns
Continuously analyze network traffic for signs of malicious activity or unusual spikes indicating potential DoS attempts. -
Disable Vulnerable Services
Temporarily disable or isolate firewall features or services that are known to be exploited until proper fixes are implemented. -
Strengthen Access Controls
Enforce strict access controls and multi-factor authentication to prevent unauthorized configuration changes. -
Conduct Regular Vulnerability Scans
Schedule frequent vulnerability assessments to identify and address new or existing weaknesses proactively.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Understand foundational security frameworks via NIST CSF on Wikipedia.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
