Cisco Alerts on Firewall Attacks Exploiting CVE-2025-20333, CVE-2025-20362

Cisco recently confirmed the emergence of new attack vectors aimed at its Secure Firewall products. These vulnerabilities primarily affect devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Specifically, these exploits are tied to CVE-2025-20333 and CVE-2025-20362.

CVE-2025-20333 and CVE-2025-20362 Vulnerabilities

These vulnerabilities may prompt unpatched devices to unexpectedly reload, culminating in denial-of-service (DoS) incidents. Cisco has advised users to implement the necessary updates immediately. Both vulnerabilities were initially disclosed in late September 2025.

Attack Exploitation and Risks

• CVE-2025-20333: This allows attackers to execute arbitrary code as root through specially crafted HTTP requests.
• CVE-2025-20362: This vulnerability enables access to restricted URLs without proper authentication.

Prior to being formally disclosed, these vulnerabilities were exploited as zero-days, facilitating the spread of malware like RayInitiator and LINE VIPER, according to the U.K. National Cyber Security Centre (NCSC).

Additional Security Updates

In addition to addressing the firewall vulnerabilities, Cisco also tackled two critical flaws within its Unified Contact Center Express (Unified CCX). These vulnerabilities could allow unauthenticated remote attackers to upload arbitrary files, bypass authentication, and execute commands with elevated privileges.

Critical Vulnerabilities in Unified CCX

• CVE-2025-20354: A critical flaw in the Java Remote Method Invocation (RMI) process with a CVSS score of 9.8, permitting unrestricted file uploads and command execution.
• CVE-2025-20358: A vulnerability in the CCX Editor application that allows for authentication bypass and unauthorized administrative access with a CVSS score of 9.4.

These vulnerabilities have been patched in several Unified CCX releases:

• Cisco Unified CCX Release 12.5 SU3 (Fixed in 12.5 SU3 ES07)
• Cisco Unified CCX Release 15.0 (Fixed in 15.0 ES01)

Additional Vulnerabilities and Remediation

Cisco also addressed a high-severity DoS vulnerability (CVE-2025-20343) in its Identity Services Engine (ISE). This flaw, with a CVSS score of 8.6, permits an unauthenticated remote attacker to restart a vulnerable device for misconfigured RADIUS access requests.

Cisco has stated that while there is no evidence of these vulnerabilities being exploited in the field, users are strongly encouraged to apply the updates without delay to maintain optimal security.