CVE-2025-20333

What is Cisco Secure Firewall ASA?

Cisco Secure Firewall Adaptive Security Appliance (ASA) is one of the world's most widely deployed enterprise firewall and VPN platforms. Cisco ASA and its next-generation successor Secure Firewall Threat Defense (FTD) provide perimeter firewall, SSL/IPsec VPN, and intrusion prevention for enterprise and government networks. The WebVPN feature provides clientless SSL VPN access, and AnyConnect IKEv2 provides full VPN connectivity for remote workers. Because ASA/FTD appliances sit at the network perimeter and serve as the primary VPN gateway, compromising one gives a nation-state actor a persistent foothold at the edge of a target's network — from which they can intercept VPN traffic, harvest credentials, and pivot inward.

Overview

CVE-2025-20333 is a CVSS 9.9 buffer overflow vulnerability (CWE-120) in the VPN Web Server component of Cisco ASA and FTD. When chained with CVE-2025-20362 (a URL path-normalization bypass that removes the authentication requirement), the combination achieves fully unauthenticated remote code execution on the firewall, enabling persistent backdoor installation. The threat actor UAT4356 (Storm-1849, the same China-aligned APT behind the 2024 "ArcaneDoor" campaign) exploited this chain as a zero-day beginning May 2025, deploying two custom backdoors — RayInitiator (a bootkit) and LINE VIPER (a modular persistence framework). CISA issued Emergency Directive ED-25-03 with a 1-day federal remediation deadline — one of the most aggressive in CISA history.

Affected Versions

Attack surface condition: Vulnerable when SSL VPN (webvpn enable), AnyConnect IKEv2 remote access with client services, or Mobile User Security (MUS) is configured.

Technical Details

CVE-2025-20333 (CWE-120): Buffer overflow in the ASA/FTD VPN Web Server. A crafted HTTPS request to the VPN web server interface overflows a stack buffer, enabling arbitrary code execution with root privileges.

CVE-2025-20362 (companion, required for full unauthenticated exploitation): URL path-normalization flaw that bypasses session verification for Clientless SSL VPN (WebVPN) endpoints. Attackers use CVE-2025-20362 to reach restricted execution pathways without authentication, then trigger CVE-2025-20333 — making the combined chain fully pre-auth despite CVE-2025-20333's PR:L CVSS rating.

Post-exploitation malware (UAT4356):

• RayInitiator: A bootkit that persists by modifying the GRUB bootloader and core system binaries — survives firmware updates and factory resets on affected hardware
• LINE VIPER: A modular framework providing command execution, network traffic capture, authentication bypass, logging suppression, and anti-forensic forced reboots triggered during core dump collection

Discovery

The vulnerability was discovered through analysis of active exploitation. Discovery credits include the Australian Signals Directorate (ASD), Canadian Centre for Cyber Security (CCCS), UK NCSC, and U.S. CISA, who collaborated on the threat intelligence that led to the advisory.

Exploitation Context

UAT4356 (Storm-1849) — the same China-aligned nation-state actor that conducted ArcaneDoor in 2024 (targeting CVE-2024-20353 / CVE-2024-20359) — exploited CVE-2025-20333 + CVE-2025-20362 as a zero-day beginning approximately May 2025, four months before the advisory. GreyNoise observed two major reconnaissance spikes in late August 2025 involving over 25,000 unique IP addresses probing for vulnerable ASA devices. UAT4356 specifically targeted older Cisco ASA 5500-X hardware (5512-X through 5585-X) running ASA 9.12 or 9.14 — appliances lacking Secure Boot/Trust Anchor features that prevent bootkit persistence. CISA issued Emergency Directive ED-25-03 on September 25, 2025 with a 1-day deadline requiring FCEB agencies to submit ASA/FTD core dump files to CISA's Malware Next Gen Portal for analysis. A new attack variant causing unexpected device reloads emerged November 5, 2025, indicating continued active exploitation.

Remediation

1. Apply Cisco patches immediately: ASA 9.12.4.72, 9.14.4.28, or the appropriate patched release for your version per the Cisco Software Checker.
2. Follow CISA Emergency Directive ED-25-03: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices — this includes collecting and submitting core dump files, and using CISA's Eviction Strategies Tool.
3. Follow CISA's Supplemental Direction for core dump and hunt instructions: https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions
4. Disable SSL VPN / WebVPN if not operationally required — this removes the attack surface entirely.
5. Replace end-of-life ASA 5500-X hardware — the 5512-X through 5585-X series lack Secure Boot and cannot fully prevent bootkit persistence; replacement with Secure Firewall 1000/2100/3100/4200 series is recommended.
6. Hunt for RayInitiator / LINE VIPER indicators: review bootloader integrity, check for unexpected core binary modifications, and monitor for unexplained device reloads.