InfoSecBulletin Cybersecurity for mankind
50k Cisco ASA and FTD devices on the internet are at risk due to two vulnerabilities being exploited by hackers. Flaws CVE-2025-20333 and CVE-2025-20362 allow remote code execution and access to restricted VPN URLs without authentication.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
On September 25, Cisco warned that the issues were actively exploited in attacks that started before patches were available to customers. There are no solutions for either flaw, but temporary measures could involve limiting VPN web interface access and enhancing logging and monitoring for unusual VPN logins and requests.
The Shadowserver Foundation reported that over 48,800 exposed ASA and FTD instances are still vulnerable to CVE-2025-20333 and CVE-2025-20362.
Most IPs are from the United States, followed by the United Kingdom, Japan, Germany, Russia, Canada, and Denmark.
As of September 29, these figures show a failure to address ongoing exploitation and earlier warnings.
Greynoise warned on September 4 about suspicious scans targeting Cisco ASA devices that began in late August. These scans often indicate potential undocumented flaws in 80% of cases.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive, allowing 24 hours for all Federal Civilian Executive Branch (FCEB) agencies to find and upgrade compromised Cisco ASA and FTD instances on their networks.
CISA also advised that ASA devices reaching their end of support (EoS) should be disconnected from federal organization networks by today (the end of the month).
