Article Details
Scrape Timestamp (UTC): 2025-11-06 15:00:17.378
Source: https://thehackernews.com/2025/11/cisco-warns-of-new-firewall-attack.html
Original Article Text
Click to Toggle View
Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362. Cisco on Wednesday disclosed that it became aware of a new attack variant that's designed to target devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software releases that are susceptible to CVE-2025-20333 and CVE-2025-20362. "This attack can cause unpatched devices to unexpectedly reload, leading to denial-of-service (DoS) conditions," the company said in an updated advisory, urging customers to apply the updates as soon as possible. Both vulnerabilities were disclosed in late September 2025, but not before they were exploited as zero-day vulnerabilities in attacks delivering malware such as RayInitiator and LINE VIPER, according to the U.K. National Cyber Security Centre (NCSC). While successful exploitation of CVE-2025-20333 allows an attacker to execute arbitrary code as root using crafted HTTP requests, CVE-2025-20362 makes it possible to access a restricted URL without authentication. The update comes as Cisco addressed two critical security flaws in Unified Contact Center Express (Unified CCX) that could permit an unauthenticated, remote attacker to upload arbitrary files, bypass authentication, execute arbitrary commands, and elevate privileges to root. The networking equipment major credited security researcher Jahmel Harris for discovering and reporting the shortcomings. The vulnerabilities are listed below - They have been addressed in the following versions - In addition to the two vulnerabilities, Cisco has shipped patches for a high-severity DoS bug (CVE-2025-20343, CVSS score: 8.6) in Identity Services Engine (ISE) that could allow an unauthenticated, remote attacker to cause a susceptible device to restart unexpectedly. "This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint," it said. "An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE." While there is no evidence that any of the three security flaws have been exploited in the wild, it's essential that users apply the updates as soon as possible for optimal protection.
Daily Brief Summary
Cisco disclosed new attack variants targeting Secure Firewall ASA and FTD software, exploiting CVE-2025-20333 and CVE-2025-20362, potentially causing denial-of-service conditions on unpatched devices.
The vulnerabilities, previously exploited as zero-day flaws, allow arbitrary code execution and unauthorized URL access, necessitating urgent updates to prevent further exploitation.
Cisco has released patches addressing these critical flaws, alongside updates for Unified Contact Center Express vulnerabilities that could permit unauthorized file uploads and privilege escalation.
A high-severity DoS vulnerability in Identity Services Engine (CVE-2025-20343) was also patched, preventing potential device restarts from crafted RADIUS access requests.
The U.K. National Cyber Security Centre confirmed malware delivery via these vulnerabilities, emphasizing the importance of rapid patch deployment.
Cisco credited security researcher Jahmel Harris for identifying these critical security issues, reinforcing the value of collaborative cybersecurity efforts.
While no active exploitation in the wild has been reported, organizations are advised to apply the latest patches immediately to safeguard their systems.