Vulnerabilities · 140 days ago
Cisco ASA and FTD devices can stay compromised after the patch lands. The standard response — fix the CVEs and move on — misses that FIRESTARTER can remain active and let attackers come back without re-exploiting the original flaw.
CISA and the UK NCSC say FIRESTARTER is tied to a widespread campaign that used CVE-2025-20333 and CVE-2025-20362 to get initial access to Cisco ASA firmware. They assess the backdoor can persist on ASA and Firepower Threat Defense systems, and CISA has updated Emergency Directive 25-03 after finding suspicious connections on a U.S. federal agency device.
The risk is no longer just vulnerable firmware. Infected appliances can keep serving as a foothold after updates, so patching removes exposure to the exploit but does not prove the device is clean.
Known exploited · CISA KEV
CVSS 6.5 MEDIUM: update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA… EPSS 87% (100th percentile).
CISA federal remediation date Sep 26 · date passed
Known exploited · CISA KEV
CVSS 9.9 CRITICAL: a vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco… EPSS 71% (99th percentile).
CISA federal remediation date Sep 26 · date passed
15 sources covering this story
Infected Cisco firewalls need cold start to clear persistent Firestarter backdoor
Admins are being warned by cyber experts from the US and UK that this is part of continuing campaign to crack Cisco firewalls.
US, UK authorities warn that Firestarter backdoor malware survives patching
A federal agency was impacted by a hacking campaign that exploited flaws in Cisco devices.
CISA and NCSC warn Firestarter malware enabling persistent backdoor access to exposed Cisco firewall infrastructure.
Cisco ASA and FTD Firewall RCE | Outbreak Alert | FortiGuard Labs
Critical zero-day vulnerabilities affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) ...
FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches
FIRESTARTER backdoor hit Cisco ASA in Sept 2025, persists after patching CVE-2025-20333, risking continued federal network access.
Firestarter malware survives Cisco firewall updates, security patches
are warning about a custom malware called Firestarter persisting on Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software.
CISA, NCSC issue Firestarter backdoor warning
: Latest in long-running pwning of Cisco kit found in mystery Fed agency
US Federal Agency’s Cisco Firewall Infected With ‘Firestarter’ Backdoor
The malware provides remote access and control of infected devices and maintains post-patching persistence.
New Cisco firewall malware can only be killed by pulling the plug - Help Net Security
Suspected state-sponsored attackers are using the Firestarter backdoor to persistently compromise Cisco Firepower devices.
US, UK agencies warn hackers were hiding on Cisco firewalls long after patches were applied
"CISA and the NCSC warn of 'Firestarter,' a persistent Cisco firewall backdoor that survives patches.
AL25-012 - Vulnerabilities impacting Cisco ASA and FTD devices – CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363 – Update 2
The Record from Recorded Future
CISA said the unnamed department was infected with malware called “FIRESTARTER” that allowed the hackers to return to the Cisco device in March without re-exploiting the original vulnerabilities.
Part of the PlainSec briefing for 2026-04-28