https://reddit.com/r/cybersecurity/comments/1nqf3bw/cisco_asaftd_zerodays_under_active_exploitation/: Cisco ASA/FTD Zero-Days Under Active Exploitation – CISA Issues Emergency Directive
Affected Software
Frequently Asked Questions
Which systems should be prioritized for remediation?
Cisco ASA and FTD devices, particularly those deployed at the network perimeter, should be prioritized. A compromise of an edge firewall could provide a path toward internal systems.
What level of access does an attacker need to exploit the flaws?
CVE-2025-20333 requires an authenticated attacker and can allow arbitrary code execution as root through crafted HTTPS requests. CVE-2025-20362 can allow an unauthenticated attacker to access restricted URLs, and the two issues may be chained to bypass authentication before obtaining root-level execution.
Would rebooting or performing a software upgrade necessarily remove an attacker?
Not necessarily. The reported ArcaneDoor activity includes firewall firmware tampering for persistence that can survive reboots or software upgrades.
What remediation urgency applies to U.S. federal agencies?
CISA Emergency Directive 25-03 requires federal agencies to patch or mitigate within 24 hours. The vulnerabilities are reported as already under active exploitation.