September 25, 2025

5 Min Read

Cisco published advisories and a supplemental post about three zero-day vulnerabilities, two of which were exploited in the wild by an advanced threat actor associated with the ArcaneDoor campaign. 

Background

Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding newly disclosed zero-day vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firewall Threat Defense (FTD) Software that were exploited.

FAQ

When were these vulnerabilities first disclosed? 

On September 25, Cisco published advisories [ 1 , 2 , 3 ] and a supplemental post regarding three zero-day vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software, Firewall Threat Defense (FTD) Software, IOS XE Software, and IOS XR Software.

What are the vulnerabilities that were disclosed? 

The following three vulnerabilities were disclosed. Two (CVE-2025-20333, CVE-2025-20362) were exploited in the wild.

Were these vulnerabilities exploited as zero-days? 

Yes, according to Cisco, CVE-2025-20333 and CVE-2025-20362 were exploited in the wild as zero-days. Both of these vulnerabilities, when chained together, allow an attacker to take over a vulnerable device.

Which threat actors are exploiting these vulnerabilities? 

According to Cisco, the malicious activity associated with CVE-2025-20333 and CVE-2025-20362 is linked to UAT4356, also known as Storm-1849, the same threat actor behind the ArcaneDoor campaign from April 2024 .

Did UAT4356/Storm-1849 exploit any vulnerabilities in the ArcaneDoor campaign? 

Yes, UAT4356 leveraged two vulnerabilities in the ArcaneDoor campaign:

Was any malware used by UAT4356/Storm-1849 in this recent campaign? 

The National Cyber Security Centre (NCSC) published an alert and a malware analysis report (MAR) detailing two pieces of malware associated with this campaign. The first malware, RayInitiator, is a multi-stage bootkit designed for persistence even if a device is rebooted or upgraded. The second malware, LINE VIPER, is a user-mode shellcode loader that deploys modular payloads to enable various post-compromise activities. It can be tasked and controlled through either HTTPS-based WebVPN sessions or ICMP.

Is there a proof-of-concept (PoC) available for these vulnerabilities? 

At the time this blog was published, there were no public proof-of-concept (PoC) exploits for any of the vulnerabilities associated with this campaign.

Cisco also patched CVE-2025-20363. Was this also exploited in the wild? 

No. Cisco did not specifically call out CVE-2025-20363 as being exploited in the wild. According to the advisory, Cisco says it was found by members of Cisco’s Advanced Security Initiatives Group (ASIG) as part of a support case.

Are patches or mitigations available for CVE-2025-20333, CVE-2025-20362, CVE-2025-20363? 

Yes, Cisco has released the following fixes for Cisco ASA and FTD.

Cisco ASA Software: 

• Cisco customers on the 9.17 branch must migrate to a fixed release to address CVE-2025-20363
• Cisco customers on the 9.17 and 9.19 branches must migrate to a fixed release to address CVE-2025-20362.

Cisco FTD Software: 

• Cisco customers on the 7.1 and 7.3 branches must migrate to a fixed release to address all three vulnerabilities.

Has Tenable released any product coverage for these vulnerabilities? 

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages as they’re released:

• CVE-2025-20333
• CVE-2025-20362
• CVE-2025-20363 

This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline .

Get more information

• Cisco Event Response: Continued Attacks Against Cisco Firewalls
• ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
• CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor 

Join Tenable's Research Special Operations (RSO) Team on Tenable Connect and engage with us in the Threat Roundtable group for further discussions on the latest cyber threats. 

Learn more about Tenable One , the Exposure Management Platform for the modern attack surface.