Threat actors are exploiting several Cisco vulnerabilities that had been issued patches in August. There have been attacks on devices that were incorrectly patched.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a cybersecurity notification this week concerning two critical Cisco vulnerabilities. The CVE-2025-30333 and CVE-2025-20362 vulnerabilities have been assigned CVSS v3.1 base scores of 9.9 and 9.8, respectively. The vulnerabilities affect systems using the Cisco Secure ASA Software or Cisco Secure FTD Software. Attackers can exploit the vulnerabilities by transmitting specially designed HTTP requests to a vulnerable web server on a system.
Cisco released patches to correct the vulnerabilities in August, cautioning that hackers can take advantage of the vulnerabilities to implement codes allowed at a high level of privilege. The vulnerabilities permit threat actors entry to restricted URL endpoints that ought to be unavailable with no authentication. By exploiting vulnerabilities, attackers can run the code on vulnerable devices. When the vulnerabilities are chained, an attacker could have total control of the devices. When the patches were released, Cisco cautioned that the ArcaneDoor campaign had already exploited the vulnerabilities as zero-days, along with two other vulnerabilities.
Although numerous companies used the patches and thought they were secured against exploitation. However, when patches are done without upgrading to the minimum software model, the companies remain vulnerable to exploitation. According to the analysis of agency-reported information, CISA has determined devices noted as ‘patched’ in the reporting form, but were upgraded to a software version that remains vulnerable to the threat activity laid out in the [Emergency Directive]. CISA instructs all companies, including HIPAA-covered entities, to confirm that the right updates are implemented. CISA has publicized guidance on how to patch the two vulnerabilities and cautioned that speedy patching is necessary, which includes patching on devices that aren’t exposed online.
Image Anastasiia, AdobeStock / logo©Cisco
