CVE-2025-20362Active Exploitation(cisco / adaptive_security_appliance_software)

CRITICALCVSS 8.6 · HIGHCISA KEV

Exploitation observed; activity peaked at 7 mentions and remains active

Immediate actions

Patch cisco adaptive_security_appliance_software systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

cisco CVEs Back to dashboard

8.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-09-26. The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362

Weakness type (CWE)

CWE-862

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

adaptive_security_appliance_software
secure_firewall_threat_defense

Threat summary

Active exploitation appears in 22 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
39 mentions across 15 observed days

What's happening

Active exploitation reported across 22 signals
Exploit tool or code specified in 3 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 11 signals
Technical details provided in 11 signals
Disclosure: 7 classified signals
General: 5 classified signals
Peaked 12d ago at 7 mentions (2026-04-24); latest day: 1
39 total mentions across 15 days

Affected systems

Vendors

cisco

Products

adaptive_security_appliance_softwaresecure_firewall_threat_defense

Deep dive

Activity timeline39 mentions / 15d

Signal classification6 categories

Active Exploitation

2051.3%

Disclosure

717.9%

General

512.8%

Exploit

37.7%

Patch

37.7%

PoC

12.6%

Referenced assets21 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-08	1	Active Exploitation1
2026-04-23	5	Active Exploitation3Exploit1General1
2026-04-24	7	Active Exploitation5Exploit1Patch1
2026-04-25	6	Active Exploitation5Disclosure1
2026-04-26	3	Active Exploitation2Disclosure1
2026-04-27	5	Active Exploitation1Disclosure2Patch2
2026-04-28	1	Active Exploitation1
2026-04-29	1	Disclosure1
2026-04-30	4	Active Exploitation1General3
2026-05-04	1	Disclosure1
2026-05-11	1	Active Exploitation1
2026-05-16	1	PoC1
2026-06-16	1	General1
2026-06-19	1	Disclosure1
2026-07-10	1	Exploit1

Full discourse20 posts

CISA Cyber@CISACyber168d
Active Exploitation
Just Released: Malware Analysis Report: FIRESTARTER Backdoor on threat actors exploiting CVE-2025-20333 & CVE-2025-20362 vulnerabilities to gain persistent remote access & control over Cisco Firepower & Secure Firewall products. Learn more 👉 https://go.dhs.gov/5Zw https://t.co/R3wYVVZbJ9
Post summary
Threat actors are actively exploiting CVE-2025-20333 and CVE-2025-20362 to gain persistent remote access to Cisco Firepower and Secure Firewall products, as detailed in a new malware analysis report.
423460189.9K
299.5K followersView on X
国家サイバー統括室(注意・警戒情報)@cyber_forecast161d
General
【注意喚起】 2026年4月30日、JPCERTがCisco ASAおよびFTDにおける複数の脆弱性（CVE-2025-20333、CVE-2025-20362）に関する注意喚起の更新等を掲載しています。ご確認ください。 https://x.com/jpcert/status/2049654217800134701
Post summary
JPCERT issued an alert update for vulnerabilities CVE‑2025‑20333 and CVE‑2025‑20362 affecting Cisco ASA and FTD devices; the notice contains no additional technical, exploit, or mitigation details.
037047114.0K
101.2K followersView on X
OFFA@0xOFFA114d
General
اول رايتب + فيديو نعملو انا و @george_adel_1 ياريت يبقا مفيد رابط الرايتب:https://medium.com/@redteam503/from-medium-to-critical-chaining-cve-2025-20362-cve-2025-20333-in-cisco-asa-ftd-across-20-9f6857bd7880 رابط الفيديو:https://www.youtube.com/watch?v=pbbP6NA0DqE
Post summary
The tweet shares links to a Medium article and a YouTube video discussing CVE‑2025‑20362 and CVE‑2025‑20333, but no substantive technical details or exploit information are presented.
05043272.7K
321 followersView on X
JPCERTコーディネーションセンター@jpcert165d
Patch
Cisco ASAおよびFTDの脆弱性（CVE-2025-20333、CVE-2025-20362）に関する注意喚起を更新。本脆弱性を悪用して機器内に潜伏・持続するマルウェアの情報が公表されています。修正を未適用の場合は速やかに適用を、適用済みでも侵害有無の確認や影響調査を検討ください。^KK https://www.jpcert.or.jp/at/2025/at250021.html
Post summary
The advisory updates users on Cisco ASA/FTD vulnerabilities (CVE-2025-20333, CVE-2025-20362), warns of malware exploiting them, and urges prompt patching and post‑patch investigation.
0902586.6K
33.9K followersView on X
JPCERTコーディネーションセンター@jpcert162d
General
JPCERT/CC WEEKLY REPORT 2026-04-30を公開。セキュリティ関連情報は15件。SKYSEA Client ViewおよびSKYMEC IT Managerの脆弱性情報や、「Cisco ASAおよびFTDにおける複数の脆弱性（CVE-2025-20333、CVE-2025-20362）に関する注意喚起」の更新などを掲載しています。^MH https://www.jpcert.or.jp/wr/2026/wr260430.html
Post summary
The JPCERT/CC weekly report lists several CVEs without detailing patches, exploits, or technical specifics.
09217518.9K
33.9K followersView on X
二本松哲也@t_nihonmatsu167d
Patch
FIRESTARTER BackdoorはFirewallそのものを永続的な侵入基盤に変える攻撃です。・ファームウェア更新では除去されない・ログに残らない・ハード電源断でしか除去不可 CVE-2025-20333（認可不備） CVE-2025-20362（バッファオーバーフロー）対象機器の特定（最優先）・Cisco ASA / Firepower / FTD ・インターネット公開機器パッチだけでは不十分・侵害前提で評価・過去に露出していたかが重要フォレンジック前提・core dump取得・メモリ解析・YARA適用検知時の対応・即時IR起動・横展開調査（認証情報漏洩）・物理電源断（条件付き）恒久対策・管理プレーン分離・TACACS+（TLS化）・特権ID監査強化・エッジ機器のゼロトラスト化
Post summary
The message centers on identifying Firestarter backdoor vulnerabilities and outlines mitigation strategies, highlighting that patches alone are insufficient and recommending additional controls.
0311131.7K
15.7K followersView on X
Team Cymru Research@teamcymru_S2183d
Active Exploitation
🚨 Top 25 CVE Exploitation Attempts - Team Cymru - S2 (Ranked by unique source IPs over 14 days) 1. CVE-2025-0282 · Ivanti Connect Secure 2. CVE-2025-49706 · SharePoint 3. CVE-2020-3452 · Cisco ASA 4. CVE-2025-61884 · Oracle EBS 5. CVE-2024-32113 · Apache OFBiz 6. CVE-2025-53770 · SharePoint 7. CVE-2025-24893 · XWiki 8. CVE-2025-61882 · Oracle EBS 9. CVE-2025-5777 · Citrix NetScaler 10. CVE-2025-34028 · Commvault 11. CVE-2024-57727 · SimpleHelp 12. CVE-2025-20362 · Cisco ASA/FTD 13. CVE-2024-1212 · Kemp LoadMaster 14. CVE-2024-38856 · Apache OFBiz 15. CVE-2022-40684 · Fortinet 16. CVE-2024-9465 · Palo Alto Expedition 17. CVE-2025-11371 · Gladinet CentreStack 18. CVE-2025-58360 · GeoServer 19. CVE-2025-57819 · FreePBX 20. CVE-2025-31324 · SAP NetWeaver 21. CVE-2024-7593 · Ivanti vTM 22. CVE-2025-31125 · Vite Dev Server 23. CVE-2025-64446 · FortiWeb 24. CVE-2024-12987 · DrayTek Vigor 25. CVE-2018-7600 · Drupal
Post summary
The tweet lists the top 25 CVEs experiencing exploitation attempts over a 14‑day window, indicating active use in the wild but offering no technical or remediation details.
070921.2K
5.5K followersView on X
DFIR Radar@DFIR_Radar164d
Active Exploitation
CISA and NCSC 🇬🇧 release detailed analysis of FIRESTARTER backdoor targeting Cisco Firepower/ASA devices. APT actors exploit CVE-2025-20333/CVE-2025-20362, deploy persistent malware that survives firmware updates and reboots. Technical details: • Linux ELF backdoor hooks into LINA processing engine, enables arbitrary shell code execution • Maintains persistence through automatic relaunching, requires full power cycle to remove • Deployed alongside LINE VIPER implant for unauthorized VPN session creation bypassing authentication • Active since September 2025, observed activity as recent as March 2026 despite patching efforts • Emergency Directive 25-03 mandates FCEB agencies collect core dumps for CISA analysis Attack methodology: • Initial access via exploitation of Cisco ASA/FTD zero-day vulnerabilities before patches available • LINE VIPER creates unauthorized VPN sessions using dormant valid accounts • FIRESTARTER deployed as persistence mechanism, survives firmware updates • Full device configuration exposed including admin credentials, certificates, private keys DFIR artifacts: • Suspicious network connections to compromised Firepower devices during monitoring • Core dumps contain malware samples for forensic analysis • VPN session logs showing unauthorized authentication bypasses • Configuration changes indicating credential/certificate compromise #DFIR_Radar
Post summary
The advisory reports that CVE-2025-20333/20362 is actively exploited via a FIRESTARTER backdoor on Cisco Firepower/ASA devices, with detailed technical exploitation and persistence mechanisms, despite patching efforts.
200421.6K
1.7K followersView on X
CrowdSec@Crowd_Security150d
Active Exploitation
🚨 In this week’s newsletter, we cover CVE-2025-20362, a Cisco ASA & FTD VPN authentication bypass still actively targeting internet-facing firewalls. We break down how attackers abuse exposed VPN infrastructure and what defenders should do next. Read the full analysis and protect your systems 👉 https://www.crowdsec.net/vulntracking-report/cve-2025-20362-cisco-asa-vpn-authentication-bypass
Post summary
The post alerts that CVE-2025-20362, a VPN authentication bypass on Cisco ASA & FTD firewalls, is still actively exploited online and directs readers to a full analysis for defensive guidance.
100301.3K
19.5K followersView on X
Cyber Recon@KaliSushanth166d
Active Exploitation
🚨 Cisco Firepower devices are under active attack! UAT-4356 is exploiting CVE-2025-20333 & CVE-2025-20362 to deploy the FIRESTARTER backdoor. ✅ Hard reboot devices ✅ Reimage systems ✅ Apply Cisco patches ✅ Follow CISA Directive 25-03 Patch now! #CyberSecurity #Cisco
Post summary
The message reveals that the UAT-4356 exploit actively targets Cisco Firepower devices via CVE-2025-20333 and CVE-2025-20362, urging immediate reboot, reimage, patching, and adherence to CISA directives.
11020724
2 followersView on X
Mr.Rabbit@01ra66it164d
Patch
【Cisco ASAおよびFTDにおける複数の脆弱性（CVE-2025-20333、CVE-2025-20362）に関する注意喚起】 JPCERT/CCがCisco ASA/FTDの注意喚起を4月27日に更新しました。今回の要点は、CVE-2025-20333やCVE-2025-20362へのパッチ適用だけで終わらないことです。 Ciscoは、脆弱性修正後も残置し得る永続化機構やFIRESTARTERバックドアに関する情報を公開しており、JPCERT/CCも国内に影響を受けるホストが多数存在するとしています。境界機器はEDRが入りにくく、侵害されるとVPNや内部ネットワークへの入口として使われ続けるおそれがあります。防御側は、ASA/FTDの対象バージョン、VPN Webサービス有効化状況、Cisco/Talos/CISAの検出手順、再イメージ化要否、証明書・鍵・ローカルパスワードのリセットを確認すべきです。連休前に「更新済みだから安全」と判断するのは危険です。 #サイバーセキュリティ #JPCERTCC #Cisco #ASA #FTD #CVE202520333 #CVE202520362 #FIRESTARTER https://www.jpcert.or.jp/at/2025/at250021.html
Post summary
The announcement emphasizes that simply applying patches for CVE‑2025‑20333 and CVE‑2025‑20362 is insufficient; it advises additional controls such as re‑imaging and resetting credentials to mitigate persistent threats.
11001929
3.5K followersView on X
Misbar | مسبار@MisbarSec166d
Disclosure
📌 تحذير من البوابة الخلفية "FIRESTARTER" في جدران الحماية من Cisco ASA حذرت السلطات الأمريكية والبريطانية من وجود بوابة خلفية تسمى "FIRESTARTER" يستغلها المهاجمون في جدران الحماية من Cisco ASA. يعود سبب حدوث ذلك إلى ثغرات أمنية، منها CVE-2025-20362 و CVE-2025-20333. تأثرت أنظمة الشبكات والأجهزة المحمية. ولم يتم الإعلان عن إجراءات محددة للاستجابة، لكن يُنصح بـ تحديث البرامج وتفعيل الحماية اللازمة. 🔗 للمزيد: https://www.security.nl/posting/933973/VS+en+VK+waarschuwen+voor+%22FIRESTARTER%22+backdoor+in+Cisco+ASA-firewalls?channel=rss
Post summary
A warning about a "FIRESTARTER" backdoor affecting Cisco ASA firewalls, referencing CVE-2025-20362 and CVE-2025-20333, and recommending software updates, but without detailed technical or exploit information.
00030682
268 followersView on X
DFIR Radar@DFIR_Radar167d
Active Exploitation
CISA reveals FIRESTARTER backdoor infected federal Cisco ASA device in Sept 2025, persisting through security patches. Malware survives firmware updates by hooking into LINA engine and maintaining persistence across reboots. Key technical details: • Exploits CVE-2025-20333 (missing authorization) and CVE-2025-20362 (buffer overflow) for initial compromise • Embeds in LINA network processing engine via XML handler hooks, enabling shellcode execution • Maintains persistence by intercepting termination signals and writing to reboot-persistent log locations • Used alongside LINE VIPER post-exploitation implant in coordinated APT campaign • Activates only after verifying victim-specific identifiers in WebVPN traffic Attack methodology: • Initial access through VPN credential exploitation or unauthenticated HTTP requests • Installs hooks in libstdc++ shared libraries and manipulates system files for persistence • Survives firmware updates unless full power cycle performed - patches don't remove existing infections • Self-reinstalls under new persistent paths while cleaning traces of previous installation DFIR artifacts: • YARA rules available from CISA for detecting malware in disk images and core dumps • Monitor for suspicious LINA process activity and unexpected XML handler modifications • Check reboot-persistent log locations for unauthorized binaries Complete device reimaging required for remediation. CISA Emergency Directive 25-03 mandates federal compliance. #DFIR_Radar
Post summary
The passage confirms that FIRESTARTER is actively exploiting CVE‑2025‑20333 and CVE‑2025‑20362 in the wild, with detailed technical information and a directive for remediation, but it does not mention a PoC or a specific exploit tool.
10011761
1.3K followersView on X
DFIR Radar@DFIR_Radar168d
Active Exploitation
State-sponsored UAT-4356 exploits n-day Cisco Firepower vulnerabilities to deploy FIRESTARTER backdoor. Campaign leverages transient persistence mechanism that survives graceful reboots but removed by hard power cycles. Key technical details: • Exploits CVE-2025-20333 and CVE-2025-20362 to compromise Cisco FXOS devices • FIRESTARTER injects into LINA process, replaces WebVPN XML handler with malicious Stage 2 shellcode • Persistence via CSP_MOUNT_LIST manipulation: copies to `/opt/cisco/platform/logs/var/log/svc_samcore.log` during reboot • Shellcode execution triggered by XML requests with custom magic byte prefixes (T1055.001, T1546.004) • Technical overlap with RayInitiator's Stage 3 capabilities confirms UAT-4356 attribution DFIR artifacts: • Process: `lina_cs` in kernel process list • Files: `/usr/bin/lina_cs`, `/opt/cisco/platform/logs/var/log/svc_samcore.log` • Memory: searches for byte sequence 0x1,0x2,0x3,0x4,0x5 in LINA process space Hunt with `show kernel process | include lina_cs` and verify file presence on affected Firepower devices. Hard reboot removes implant; reimaging recommended for complete remediation. Full IOCs in Cisco Security Advisory. #DFIR_Radar
Post summary
The post details an active state‑sponsored exploitation campaign against Cisco Firepower devices using CVE‑2025‑20333/20362, describing infection methods, persistence, and recommended remediation.
10110614
1.3K followersView on X
Curtis Houghton@CurtisHoughton4145d
PoC
Python vulnerability scanner for Cisco CVE-2025-20362 #Cisco #vulnerability #redteam #pentest #cybersecurity https://github.com/curtishoughton/CVE-2025-20362-Cisco-Scanner
Post summary
A GitHub repository offers a Python-based scanner for Cisco CVE‑2025‑20362, acting as a proof‑of‑concept for detecting the vulnerability.
010011.6K
169 followersView on X
Cyber Recon@KaliSushanth166d
Active Exploitation
🚨 Cisco Firepower devices are under active attack! UAT-4356 is exploiting CVE-2025-20333 & CVE-2025-20362 to deploy the FIRESTARTER backdoor. ✅ Hard reboot devices ✅ Reimage systems ✅ Apply Cisco patches ✅ Follow CISA Directive 25-03 Patch now! #CyberSecurity #Cisco
Post summary
The post warns that Cisco Firepower devices are being actively targeted via UAT-4356 exploiting CVE-2025-20333 and CVE-2025-20362, urging immediate patching.
01010657
2 followersView on X
NOCTIS@NoctisIntel167d
Exploit
UAT-4356 (China-nexus) exploiting Cisco FXOS CVE-2025-20333: web mgmt RCE (unauth) CVE-2025-20362: CLI auth bypass Chain: bypass → RCE → firmware implant (REPTILE/SEASPY) Targets: enterprise/gov perimeter devices #ThreatIntel #APT #CVE #UAT4356
Post summary
The note identifies two Cisco FXOS CVEs that can be chained to achieve unauthenticated web‑management RCE followed by a CLI auth bypass, enabling the deployment of known firmware implants (REPTILE/SEASPY) by threat actors targeting enterprise and government perimeter devices.
10010636
3 followersView on X
Gagan Suie@gagansuie90d
Exploit
UAT4356 chained two Cisco zero-days: CVE-2025-20362, an unauthenticated authorization bypass, into CVE-2025-20333, remote code execution. Result: full root on ASA and FTD firewalls, with no credentials required.
Post summary
A chain of two Cisco zero‑day vulnerabilities (unauthenticated authorization bypass and remote code execution) is capable of achieving full root on ASA and FTD firewalls without requiring credentials.
1000057
193 followersView on X
BBWriteup@bbwriteup111d
Disclosure
"From Medium to Critical: Chaining CVE-2025–20362 & CVE-2025–20333 in Cisco ASA/FTD Across 20+…" by 0xDyad #BugBounty #Cybersecurity #Hacking #InfoSec https://medium.com/@redteam503/from-medium-to-critical-chaining-cve-2025-20362-cve-2025-20333-in-cisco-asa-ftd-across-20-9f6857bd7880
Post summary
The tweet announces a Medium article that discusses chaining CVE‑2025‑20362 and CVE‑2025‑20333 to elevate severity, but it does not provide technical details, PoC, or evidence of exploitation.
00010168
699 followersView on X
iototsecnews@iototsecnews162d
Active Exploitation
Cisco Firepower の脆弱性 CVE-2025-20333／20362：パッチ未適用環境に APT がバックドアを展開 https://iototsecnews.jp/2026/04/24/hackers-exploit-cisco-firepower-n-day-flaws-for-unauthorized-access/ この深刻な事態の原因は、Cisco Firepower デバイスの基本ソフト (FXOS) に残存する、未対応の脆弱性 CVE-2025-20333／CVE-2025-20362 が放置されていたことにあります。攻撃者は、これらの N-Day 脆弱性を突くことで侵入し、デバイスを制御するためのカスタム・バックドア FIRESTARTER を設置しています。このバックドアは、通信を処理する LINA プロセスの正常な機能を、攻撃者専用の入り口へと巧妙に書き換えてしまいます。”magic bytes” が含まれた通信が届いた時だけ、悪意の命令を実行するため、普段の動作からは異常が非常に見えにくい状況となります。ご利用のチームは、ご注意ください。 #Backdoor #Cisco #Exploit #FirePOWER #Vulnerability
Post summary
The CVE‑2025‑20333 and CVE‑2025‑20362 vulnerabilities on Cisco Firepower are actively exploited; attackers install a custom FIRESTARTER backdoor that secretly rewrites the LINA process to accept magic byte commands, enabling stealthy execution on unpatched devices.
01000724
485 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	cisco	adaptive_security_appliance_software	-	-	-
App	cisco	secure_firewall_threat_defense	-	-	-

Explore more

Back to dashboard cisco CVEs adaptive_security_appliance_software vulnerabilities

What researchers are saying

CVE-2025-20362

二本松哲也[verified]@t_nihonmatsuPatch

The message centers on identifying Firestarter backdoor vulnerabilities and outlines mitigation strategies, highlighting that patches alone are insufficient and recommending additional controls.

Team Cymru Research[verified]@teamcymru_S2Active Exploitation

The tweet lists the top 25 CVEs experiencing exploitation attempts over a 14‑day window, indicating active use in the wild but offering no technical or remediation details.

DFIR Radar[verified]@DFIR_RadarActive Exploitation

The advisory reports that CVE-2025-20333/20362 is actively exploited via a FIRESTARTER backdoor on Cisco Firepower/ASA devices, with detailed technical exploitation and persistence mechanisms, despite patching efforts.

CrowdSec[verified]@Crowd_SecurityActive Exploitation

The post alerts that CVE-2025-20362, a VPN authentication bypass on Cisco ASA & FTD firewalls, is still actively exploited online and directs readers to a full analysis for defensive guidance.

Mr.Rabbit[verified]@01ra66itPatch

The announcement emphasizes that simply applying patches for CVE‑2025‑20333 and CVE‑2025‑20362 is insufficient; it advises additional controls such as re‑imaging and resetting credentials to mitigate persistent threats.

Misbar | مسبار[verified]@MisbarSecDisclosure

A warning about a "FIRESTARTER" backdoor affecting Cisco ASA firewalls, referencing CVE-2025-20362 and CVE-2025-20333, and recommending software updates, but without detailed technical or exploit information.

DFIR Radar[verified]@DFIR_RadarActive Exploitation

The passage confirms that FIRESTARTER is actively exploiting CVE‑2025‑20333 and CVE‑2025‑20362 in the wild, with detailed technical information and a directive for remediation, but it does not mention a PoC or a specific exploit tool.

DFIR Radar[verified]@DFIR_RadarActive Exploitation

The post details an active state‑sponsored exploitation campaign against Cisco Firepower devices using CVE‑2025‑20333/20362, describing infection methods, persistence, and recommended remediation.