The U.S. Cybersecurity and Infrastructure Security Agency is ordering federal agencies to scan for and report possible compromises involving Cisco network gear affected by two exploited security flaws – after confirming at least one federal civilian agency was successfully breached.
The directive tells network administrators and security staff to assess deployed Cisco Firepower 1000, 2100, 4100 and 9300 series appliances, as well as Secure Firewall 200, 1200, 3100, 4200 and 6100 series firewalls, collect device core dumps for upload to CISA’s Malware Next Gen analysis portal, and report required forensic data to CISA by midnight Friday. All agencies must also provide a full Firepower device inventory by May 1.
What Makes This Cisco Firewall Vulnerability Different From Others
“CISA is issuing V1 to supersede the required actions in Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices,” the agency said. “V1 provides updated and new required actions, an additional reporting requirement, and applies to any agency running affected products.”
The order concerns two exploited vulnerabilities in Cisco firewall gear. The first vulnerability, tracked as CVE-2025-20333, is a critical (CVSS 9.8) flaw that can allow authenticated remote code execution as root. The send bug, tracked as CVE-2025-20362, is a high-severity flaw (CVSS 8.6) that can expose restricted URL endpoints without authentication that enables privilege escalation.
ArcaneDoor Campaign Update: Same Hackers, Smarter Malware
The updated directive — issued jointly with the U.K. National Cyber Security Centre —comes after CISA and Cisco warned about newly discovered malware known as FIRESTARTER. The backdoor can give attackers remote access to compromised Cisco ASA and Firepower Threat Defense devices and execute code inside core firewall processes. Cisco Talos attributed the activity to UAT-4356, a threat cluster it previously tied to the state-sponsored ArcaneDoor espionage campaign.
In the confirmed breach, attackers first deployed a separate implant called LINE VIPER to harvest device configurations, credentials and encryption keys, then installed FIRESTARTER as a persistence mechanism. When the agency patched its systems in September 2025, FIRESTARTER survived — and the attackers used it to redeploy LINE VIPER in March 2026, nearly six months later, without re-exploiting the original vulnerabilities.
FIRESTARTER stands out because it embeds directly into LINA, a core process in Cisco ASA and Firepower Threat Defense appliances, allowing attackers to execute arbitrary code from inside the firewall itself, according to a Thursday research note by Cisco Talos.
It achieves persistence by rewriting the device’s Service Platform mount list — a configuration file governing boot-time programs — so it relaunches itself after software updates or standard reboots.
Researchers said the malware hijacks legitimate WebVPN request handling and looks for specially crafted XML requests to trigger payload execution.
FIRESTARTER is especially concerning because patching alone may not remove the implant from devices that were already compromised. Cisco said affected systems may need to be reimaged or otherwise remediated, depending on the device and configuration. While ASA devices are not vulnerable to FIRESTARTER’s persistence mechanism, they remain at risk of initial exploitation if unpatched.
How to Remove Cisco Firewall Malware — and Why Patching Isn’t Enough
The malware also uses a transient persistence technique, according to Cisco Talos researchers, that can survive graceful reboots while removing traces of its own persistence mechanism from disk, according to Talos. CISA has determined the only reliable method to remove the implant is a hard power cycle — physically unplugging the device from its power source.
“FIRESTARTER can persist as an active threat on Cisco ASA devices or FTD software,” CISA said. “CISA encourages organizations using these devices or software to review the FIRESTARTER report, assess devices for compromise, implement mitigations, and report any findings to CISA.”
If an agency finds evidence of compromise, CISA directs it to keep the device powered on, disconnect it from the network immediately and contact CISA for further assistance.
If no evidence of compromise is found, administrators can proceed with Cisco’s recommended software updates and mitigation steps.
Shaun Nichols is an IT news journalist. He has spent nearly 20 years covering the industry with a specialty in the cybersecurity
