Cisco CVEs: What You Need to Know About These Zero-Day Vulnerabilities

On September 24, 2025, Cisco released information on a series of CVEs impacting Cisco devices. Among them were three particularly concerning vulnerabilities that appear to be associated with a malware campaign by an advanced threat actor. Cisco’s reporting assesses with high confidence that the campaign is related to the ArcaneDoor campaign of 2024 (read more here).

While Cisco and the NCSC only report attacks on ASA-5500-X series platforms (many of which are end of support), the vulnerabilities are not limited solely to the ASA 5500-X platform.

Fortunately, Cisco has also provided a great reference chart for the fixed versions of all the impacted ASA and FTD software versions:

Figure 1: Source - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks

Tanium customers can use Tanium Comply’s Remote Authenticated Scan capabilities to scan Cisco devices for vulnerabilities.

In the hours and days following the publication of these vulnerabilities, several governments released more detailed instructions and analysis of an advanced, ongoing campaign with multiple pieces of sophisticated malware targeting these devices.

CISA Emergency Directive

NCSC Malware Analysis Report for LINEVIPER & RayInitiator

NOTE: The NCSC Malware Analysis Report indicates that attacks were targeting ASA devices running 9.12(4)67 and 9.14(4)24. Cisco notes that the devices observed in the campaign cannot run SecureBoot or TrustAnchor technologies, which facilitates successful compromise in this campaign. It is unclear currently which vulnerability is directly responsible for the initial bootloader compromise.

Detection of Associated Malware

This section describes detection of compromise related to the attack campaigns that were first reported in September 2025, which is different than detection of endpoints running vulnerable software versions, previously described in the Overview section of this document.

The National Cyber Security Centre of the United Kingdom released an exceptionally detailed technical writeup of the malware targeting the ASA 5500-X devices. The comprehensive report can be downloaded here. The malware includes two pieces—a bootkit named RayInitiator and a loader known as LINE VIPER; LINE VIPER, specifically, seems to share attributes with some previous Cisco ASA malware seen a year or so prior, though the comparisons are out of scope for this analysis.

The vulnerabilities leveraged in these attacks also impact Cisco Firepower Threat Defense devices, however those devices do support secure boot, and this malware would be unlikely to persist undetected on those devices.

RAYINITIATOR

RayInitiator refers to a persistent, multi-stage bootkit targeting Cisco ASA devices that have reached their last day of support or will reach end of support by September 30, 2025. It is specifically targeting devices that cannot support secure boot. While RayInitiator may not be an immediately known threat to FTD devices, those devices should still be patched or hardware upgraded as soon as possible.

RayInitiator modifies the boot process and installs hooks deep within system tables, making it invisible to detection by standard admin tools.

LINE VIPER

LINE VIPER appears to be a successor to 2024’s LINE DANCER and LINE RUNNER, however it has had a bit of a glow-up with advanced obfuscation techniques and modular, extensible capabilities including pcap harvesting, targeted log suppression, and anti-forensics techniques.

The maturity of LINE VIPER shows up in many of its features, including its use of victim-specific tokens and encrypted communications so even intercepted traffic is difficult to analyze.

Traditional forensic methods (disk or memory analysis) may not be effective unless specialized tools and techniques are used. The NCSC report and CISA’s website provide multiple scripts and YARA rules for analysis alongside technical guidance.

Detection often requires physical access to the device and advanced forensic techniques, such as analyzing core dumps for specific hooks or using the NCSC-provided Python scripts and YARA rules. Reports about this malware highlight the anti-forensics techniques and use of volatile memory; this requires analysis should be done with care and the devices should not be powered off. Powering off the devices will wipe the volatile memory and could remove essential forensic artifacts.

Forensic Collection

The United States Cybersecurity and Infrastructure Security Agency (CISA) released comprehensive instructions on how to prepare Cisco ASA devices, perform a core dump, and analyze the output for signs of compromise. You can view the detailed instructions for Cisco ASA devices here.

While CISA’s notification addresses the importance of careful collection of forensic evidence, it is worth highlighting again—there are some VERY specific guidelines to ensure you do not trigger anti-forensic measures:

The listed steps must be completed in the order they are listed and exactly as written. Any deviation from the guidance below may trigger the threat actor’s anti-forensics measures, which will destroy forensic data and disrupt ongoing investigations. CISA is not aware of all anti-forensics and operational security measures established by the threat actor, but the below are examples based on what has been observed, so far.

• Do NOT use the “tab”, autocomplete, or any other autocomplete function. The threat actor has hooked these commands to crash the device.
• Do NOT take any other remediation actions beyond what is described below (i.e., blocking IPs, etc.) without consulting with CISA first. The threat actor is closely monitoring for changes and is able to pivot rapidly to new infrastructure.

NOTE: Crashing the device would presumably force a reboot, clearing the memory and any artifacts. This is either a very clever way to trick the analyst into losing valuable forensic evidence, or an unexpected bug with a convenient side effect (for the adversary).

Mitigation & Upgrade

This combination of vulnerabilities and malware present a serious threat to organizations running impacted systems. Organizations should perform due diligence in investigations but upgrading and proceeding through encryption key and password rotation as though breach had been confirmed is sound advice.

Per Cisco’s own guidance, “In cases of suspected or confirmed compromise on any Cisco firewall device, all configuration elements of the device should be considered untrusted. Cisco recommends that all configurations—especially local passwords, certificates, and keys—be replaced after the upgrade to a fixed release. This is best achieved by resetting the device to factory defaults after the upgrade to a fixed release using the configure factory-default command in global configuration mode and then reconfiguring the device with new passwords, certificates, and keys from scratch." If the configure factory-default command should not be supported, use the commands write erase and then reload instead.

For organizations and agencies required to comply with the instructions in CISA’s ED 25-03, further instructions on generating and submitting core dumps for forensic evidence are provided in detail.

For non-ASA hardware, organizations can apply the September 2025 updates from Cisco.