Cisco ASA/FTD VPN Exploit Campaign Follows Coordinated Scanning

Attackers conducted coordinated reconnaissance and exploitation attempts against Cisco ASA and Secure Firewall Threat Defense (FTD) WebVPN services affected by CVE-2025-20362 and CVE-2025-20333. The vulnerabilities, disclosed in September 2025 and actively exploited, allow authentication bypass and authenticated remote code execution; chaining them enables unauthenticated device takeover. ELLIO observed approximately 500 new scanning IP addresses during November 10–17, followed roughly two days later by exploitation attempts from 75 IP addresses. Path-traversal POST requests generally contacted each observed target only once and originated primarily from infrastructure associated with PureVoltage Hosting and Fast Servers. Only one IP overlapped between scanning and exploitation, suggesting compartmentalized infrastructure, but ELLIO did not establish attribution or confirm successful compromises.

CERT-FR reported public exploit code on October 6 and subsequently highlighted Cisco’s warning of attacks causing remote denial of service on vulnerable devices. Organizations should prioritize available updates and compromise assessment, preserve diagnostic evidence externally, investigate potential lateral movement, and rotate potentially exposed secrets. Cisco recommends disabling IKEv2 and SSL VPN services pending patch deployment. CERT-FR advises considering Internet disconnection for potentially compromised devices and disconnecting devices for which no update is available; reconnaissance monitoring can also help identify targeting before exploitation.