Cisco ASA/FTD flaws exploited with persistent implant
Attackers are chaining Cisco Secure Firewall ASA and FTD vulnerabilities for remote code execution, and the resulting implant can survive patching.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-20333 and CVE-2025-20362 as exploited in the wild.
Japan's IPA has reissued a security alert covering vulnerabilities in Cisco Secure Firewall ASA and Cisco Secure FTD that allow remote code execution and denial-of-service when chained with an access-control bypass flaw. IPA confirmed active exploitation in the wild and warned that damage could expand, urging organizations to patch immediately.
Mentioned in this report
Detection guidance
Cisco ASA/FTD Suspicious Process Execution Post-Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unusual process spawning from Cisco ASA/FTD system processes following exploitation attempts, indicating post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco ASA/FTD Suspicious Process Execution Post-Exploitation
description: Detects process creation from Cisco ASA/FTD core system processes (lina,
dm-agent) with unusual command-line patterns or binary names indicative of post-exploitation
activity. These processes should not spawn child processes in normal operation.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /lina
- /dm-agent
Image|endswith:
- /bash
- /sh
- /curl
- /wget
- /nc
- /python
- /perl
filter_legitimate_maintenance:
CommandLine|contains:
- tech-support
- logging
condition: selection and not filter_legitimate_maintenance
falsepositives:
- Cisco administrative tools or system update scripts spawning shell subprocesses
- Vendor-supplied diagnostics or logging utilities
level: high
id: e1b16281-83eb-56bd-9146-5516c6ca4c03
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20251106.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs