Cisco ASA / FTD CVE-2025-20333 and CVE-2025-20362 (ArcaneDoor, RayInitiator / LINE VIPER, CISA ED 25-03): which releases fix them, and is upgrading enough?

What it is: on September 25, 2025 Cisco disclosed two zero-days in the VPN web server of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD): CVE-2025-20362 (missing authorization, lets an unauthenticated attacker reach protected URLs) and CVE-2025-20333 (buffer overflow leading to code execution). Chained, they gave a state-linked actor (the ArcaneDoor group) full control of firewalls. On some older ASA 5500-X models the attackers installed RayInitiator, a bootkit that survives reboots and firmware upgrades, plus the LINE VIPER implant. CISA issued Emergency Directive 25-03. A third flaw fixed at the same time, CVE-2025-20363, affects ASA, FTD, IOS, IOS XE and IOS XR. Am I affected: - ASA or FTD with WebVPN / AnyConnect (Secure Client) / SSL VPN or other web services enabled, on releases before the first fixed release for your train. - Use the Cisco Software Checker or the advisory's fixed-release table for your exact train. Examples from Cisco's tables: ASA 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14 or 9.23.1.19 fix both CVEs; FTD 7.0.8.1, 7.4.2.4 or 7.6.1 fix both. Other trains have their own fixed builds; some older ones have none and must be migrated. - End-of-support ASA 5500-X models (for example 5512-X to 5585-X) were the ones seen with the persistent bootkit; Cisco and CISA recommended retiring them. Fix: 1. Upgrade every ASA and FTD to a fixed release (or newer) from the advisory. 2. Before upgrading, follow Cisco's and CISA's guidance for checking compromise (CISA's ED 25-03 core-dump and hunt instructions), because upgrading doesn't remove an implant on affected older hardware. 3. If compromise is found or suspected: treat the device as untrusted, reset it to factory settings or replace it, then reconfigure from known-good settings with all new passwords, certificates and keys. Retire end-of-support hardware. After: rotate VPN user, LDAP/RADIUS shared secrets and admin credentials that passed through the firewall, review VPN logs for unusual sessions, and keep management interfaces off the internet. Sources: https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ https://unit42.paloaltonetworks.com/?p=159141 https://labs.beazley.security/advisories/BSL-A1134