InfoSecBulletin Cybersecurity for mankind
50k Cisco ASA and FTD devices on the internet are at risk due to two vulnerabilities being exploited by hackers. Flaws CVE-2025-20333 and CVE-2025-20362 allow remote code execution and access to restricted VPN URLs without authentication.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
On September 25, Cisco warned that the issues were actively exploited in attacks that started before patches were available to customers. There are no solutions for either flaw, but temporary measures could involve limiting VPN web interface access and enhancing logging and monitoring for unusual VPN logins and requests.
The Shadowserver Foundation reported that over 48,800 exposed ASA and FTD instances are still vulnerable to CVE-2025-20333 and CVE-2025-20362.
Most IPs are from the United States, followed by the United Kingdom, Japan, Germany, Russia, Canada, and Denmark.
As of September 29, these figures show a failure to address ongoing exploitation and earlier warnings.
Greynoise warned on September 4 about suspicious scans targeting Cisco ASA devices that began in late August. These scans often indicate potential undocumented flaws in 80% of cases.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive, allowing 24 hours for all Federal Civilian Executive Branch (FCEB) agencies to find and upgrade compromised Cisco ASA and FTD instances on their networks.
CISA also advised that ASA devices reaching their end of support (EoS) should be disconnected from federal organization networks by today (the end of the month).
