Cisco ASA/FTD WebVPN Auth Bypass + Buffer Overflow (ArcaneDoor)
- Product
- Cisco Secure Firewall ASA / FTD VPN web server
- CVE
- CVE-2025-20333CVE-2025-20362
- Disclosed
- 2025-09-25
- CVSS
- 9.9
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Cisco ASA and FTD software with AnyConnect/SSL VPN or WebVPN-related web services enabled.
- Fixed
- Fixed ASA/FTD releases listed in Cisco advisories cisco-sa-asaftd-webvpn-z5xP8EUB and -YROOTUW.
Summary
Cisco and CISA reported the ArcaneDoor actor (UAT4356) chaining a missing-authorization bug with a buffer overflow in the ASA VPN web server, then tampering with ROMMON on older ASA 5500-X devices for persistence. CISA issued Emergency Directive 25-03.
Root cause
CVE-2025-20362: improper validation of HTTP requests let unauthenticated users reach restricted VPN URL endpoints. CVE-2025-20333: a buffer overflow in processing input to those endpoints gives root code execution; normally it requires valid VPN credentials, which 20362 removes.
Impact
Unauthenticated root code execution on the firewall and persistent bootkit implants on unsupported hardware.
Detection
Follow CISA ED 25-03 core-dump and hunt procedures; version-check against Cisco's fixed releases.
Mitigation
Upgrade, replace end-of-support ASA 5500-X hardware, and rotate credentials and keys.