Cisco warns of a Critical remote code execution flaw in web services across multiple Cisco platforms.  Tracked as CVE-2025-20363 (CWE-122), this vulnerability carries a CVSS 3.1 Base Score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and impacts ASA, FTD, IOS, IOS XE, and IOS XR Software.

Cisco Input Validation Flaw (CVE-2025-20363)

The flaw stems from improper validation of user-supplied input in HTTP requests. Attackers can craft malicious HTTP packets to bypass exploit mitigations and execute arbitrary shell commands as root. 

For Cisco Secure Firewall ASA and FTD, no authentication is required; for IOS, IOS XE, and IOS XR, only low-privileged authenticated access is needed.

Affected services listen on SSL or HTTP ports when features such as webvpn, AnyConnect SSL VPN, or the HTTP server are enabled. Example CLI checks:

Successful exploitation yields a root shell, potentially leading to full device compromise. 

Cisco acknowledges Keane O’Kelley of Cisco ASIG for discovering the defect. Coordination with ASD, CSE, NCSC, and CISA contributed to the advisory.

All ASA Series (5500-X, ASAv, Firepower 1000/2100/4100/9000, Secure Firewall 1200/3100/4200), FTD platforms, IOS routers with SSL VPN, IOS XE routers, and ASR 9001 running 32-bit IOS XR with HTTP enabled are vulnerable. 

No workarounds exist. Customers must upgrade to fixed releases immediately. The advisory provides detailed fixed versions per platform under the Fixed Software section.

Cisco recommends using the Cisco Software Checker to identify vulnerable releases and the earliest patches. Administrators should audit device configurations to confirm SSL VPN or HTTP server status. 

For ASA/FTD, verify webvpn or AnyConnect SSL VPN settings; for IOS XR, ensure run uname -s returns Linux or disable HTTP via no http server. Cisco PSIRT confirms no active exploitation in the wild.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Critical Cisco Vulnerability Let Remote Attackers Execute Arbitrary Code on Firewalls and Routers appeared first on Cyber Security News.

Cybersecurity authorities are urging organizations to take immediate action following the discovery of a sophisticated espionage campaign targeting Cisco Adaptive Security Appliance (ASA) firewalls.

In a significant update, Cisco and the UK’s National Cyber Security Centre (NCSC) have revealed that a state-sponsored threat actor is exploiting a zero-day vulnerability (CVE-2025-20333) in Cisco ASA 5500-X series devices to deploy advanced malware, execute commands, and exfiltrate sensitive data.

The NCSC has published a detailed analysis of the malware involved, a toolset comprising a bootkit named RayInitiator and a memory-resident payload called LINE VIPER.

The campaign represents a “significant evolution” in tactics compared to previous attacks, demonstrating the actor’s deep expertise and improved operational security.

A Sophisticated and Persistent Threat

The attack begins with the deployment of RayInitiator, a highly persistent, multi-stage bootkit that flashes itself to the device’s Grand Unified Bootloader (GRUB).

This allows the malware to survive system reboots and even firmware upgrades, establishing a permanent foothold on the compromised firewall.

RayInitiator specifically targets Cisco ASA models that lack secure boot technology, many of which are approaching their end-of-life dates. Its primary function is to create a pathway for the main payload.

Once persistence is achieved, the attackers deploy LINE VIPER, a versatile shellcode loader that executes directly in the device’s memory. LINE VIPER grants the threat actor extensive control over the compromised system, with capabilities including:

• Command Execution: Running arbitrary commands with the highest privilege level (level 15).ncsc-mar-rayinitiator-line-viper.pdf
• Data Exfiltration: Performing covert packet captures of sensitive network traffic, such as RADIUS, LDAP, and TACACS authentication protocols, to harvest credentials.
• Defense Evasion: Suppressing specific syslog messages to hide malicious activity from administrators and employing anti-forensics techniques that can reboot the device if a memory dump or certain analysis commands are attempted.
• Access Bypass: Maintaining a list of actor-controlled devices to bypass Authentication, Authorization, and Accounting (AAA) checks.

The malware’s command-and-control (C2) communications are heavily encrypted and difficult to detect. The primary method uses HTTPS WebVPN client authentication sessions, with victim-specific tokens and RSA keys securing the connection.

A secondary C2 channel utilizes ICMP requests tunneled within a VPN session, with exfiltrated data sent back over raw TCP packets.

Mitigations

Both Cisco and the NCSC are urging network defenders to address this threat immediately.

In a security advisory, Cisco has provided guidance for remediation and released patches to address the vulnerabilities. Organizations are strongly advised to apply these security updates without delay.

The NCSC calls on administrators using affected products to urgently investigate for signs of compromise, using the YARA rules and detection guidance provided in its malware analysis report.

One key indicator of a LINE VIPER infection is the device rebooting immediately when an administrator attempts to generate a core dump for forensic analysis.

A critical concern highlighted by the NCSC is the use of obsolete hardware. Many of the targeted Cisco ASA 5500-X series models will be out of support in September 2025 and August 2026.

The NCSC strongly recommends that organizations replace or upgrade these end-of-life devices, as they present a significant and inherent security risk. Any suspected compromises should be reported to the NCSC or the appropriate national cybersecurity agency.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Hackers Exploiting Cisco ASA Zero-Day to Deploy RayInitiator and LINE VIPER Malware appeared first on Cyber Security News.