🚨 The Cybersecurity and Infrastructure Security Agency (#CISA) has flagged active attacks exploiting two critical flaws in #Cisco ASA and Firepower devices (CVE-2025-20362 + CVE-2025-20333) used in the #ArcaneDoor campaign.
Read: https://hackread.com/cisa-attacks-cisco-asa-firepower-flaws/
Source : BleepingComputer — Cisco avertit que deux vulnérabilités déjà exploitées en zero-day contre ses pare-feux ASA/FTD (CVE-2025-20362 et CVE-2025-20333) sont désormais utilisées pour provoquer des redémarrages en boucle, entraînant des dénis de service. La CISA a émis une directive d’urgence pour les agences fédérales américaines. • Vulnérabilités et impact: les failles CVE-2025-20362 (accès non authentifié à des endpoints URL restreints) et CVE-2025-20333 (RCE après authentification) peuvent, en chaîne, donner un contrôle total des systèmes non patchés. Un nouvel artéfact d’attaque observé le 5 novembre 2025 force des redémarrages inattendus des appareils, causant un DoS.
Selon Horizon3.ai, plusieurs vulnérabilités critiques affectant les composants WebVPN de Cisco ASA et FTD sont exploitées activement par l’acteur UAT4356, dit ArcaneDoor, ce qui a conduit la CISA à publier l’Emergency Directive 25-03. Les versions concernées sont Cisco ASA 9.16–9.23 et Cisco FTD 7.0–7.7. 🚨 Vulnérabilités et impact CVE-2025-20362 (bypass d’authentification) permet, via des requêtes HTTP(S) forgées, d’atteindre des endpoints WebVPN restreints. Chaînée avec CVE-2025-20333, cette faille conduit à une exécution de code à distance (RCE) en root, sans authentification, via des requêtes HTTPS malveillantes. CVE-2025-20363 constitue une RCE distincte affectant ASA/FTD sans authentification et certains composants Cisco IOS avec authentification. 🎯 Menace et attribution
The blog post from Talos Intelligence reveals a sophisticated espionage campaign named ArcaneDoor, which targets perimeter network devices from various vendors. These devices are essential for data entry and exit, making them attractive targets for state-sponsored actors. The campaign has seen a significant increase in the past two years, particularly affecting telecommunications providers and energy sector organizations. Cisco Talos, with its extensive visibility into network security, played a key role in identifying this campaign.
#cybersecurity #cisco #talos #intelligence #ArcaneDoor #network
Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVEs related to the event. We assess with high confidence this activity is related to same threat actor as ArcaneDoor in 2024.
#ArcaneDoor - New #espionage -focused campaign found targeting perimeter network devices
#security
Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVEs related to the event. We assess with high confidence this activity is related to same threat actor as ArcaneDoor in 2024.
Potential APT campaign targets network devices, exploiting vulnerabilities to deploy custom malware. Utilizing data exfiltration, lateral movement, and persistent access along with sophisticated in-memory techniques and crash dump hooks to evade detection. #CyberSecurity
#ArcaneDoor
Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVEs related to the event. We assess with high confidence this activity is related to same threat actor as ArcaneDoor in 2024.
#Cisco Releases Security Updates Addressing #arcanedoor Vulnerabilities in Cisco Firewall Platforms
Hackread.com
CyberVeille.ch
Censys
83r71n
PrivacyDigest
ѕ¢я1ρt 👾
deltatux 
Geeky Malcölm 🇨🇦