Cisco ASA/FTD Flaws Under Siege: 50,000 Devices at Risk from Active Exploits

Daily Security Review

Two newly disclosed critical vulnerabilities—CVE-2025-20333 and CVE-2025-20362—are wreaking havoc across the global cybersecurity landscape, with nearly 50,000 Cisco ASA and FTD appliances actively under threat. These flaws enable unauthenticated remote code execution and VPN access compromise, giving attackers an immediate foothold into critical infrastructure. Despite Cisco issuing warnings and patches, exploitation began weeks earlier, suggesting adversaries had advanced knowledge of the flaws.

The situation escalated so severely that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive, ordering federal agencies to identify and patch affected devices within 24 hours—or disconnect them if end-of-life. Still, threat scans show over 48,800 devices remain unpatched, with the largest exposure in the United States.

Attackers are deploying sophisticated malware, including the Line Viper shellcode loader and the RayInitiator GRUB bootkit, designed for stealthy persistence and deep system compromise. Reconnaissance scans were observed weeks before public disclosure, underscoring the deliberate and coordinated nature of this campaign.

In this episode, we break down the global scope of exposure, the advanced tooling used by attackers, and the national-level response from agencies like CISA. We also explore the organizational risks of slow patch adoption, the catastrophic implications of firewall compromise, and the urgent defensive measures enterprises must take to protect their networks.

#Cisco #CVE202520333 #CVE202520362 #ASA #FTD #Firewall #Cybersecurity #CISA #CriticalVulnerabilities #LineViper #RayInitiator #RemoteCodeExecution #VPNCompromise