Cisco has issued a critical security advisory warning of a “new attack variant” that is actively exploiting two known vulnerabilities in its enterprise-grade firewalls. The alert, published November 5, 2025, warns that the attack targets Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software.
The new attack variant exploits a chain of two vulnerabilities:
CVE-2025-20333: A buffer overflow vulnerability in the VPN web server.
CVE-2025-20362: A missing authorization vulnerability.
According to the advisory, the new attack can cause unpatched devices to “unexpectedly reload,” leading to a complete Denial of Service (DoS) condition. Cisco “strongly recommends” that all customers upgrade to fixed software releases immediately. Critically, the advisory notes that there are “no workarounds” that address this vulnerability.
The ASA and FTD firewalls serve as network security infrastructure for enterprise and government organizations, controlling access to internal systems including identity and access management platforms, Active Directory, and VPN services. A DoS attack that forces these devices offline can render an organization’s entire network and identity infrastructure unavailable to users.
Cisco has been dealing with a series of security challenges in recent months. The company issued multiple critical advisories for its networking equipment earlier this year and has faced scrutiny over vulnerability disclosure practices. The cybersecurity community has raised concerns about the active exploitation of firewall vulnerabilities, particularly as these devices are often exposed to the internet and serve as critical chokepoints for network security.
The company has released patches for affected software versions and is urging immediate deployment across customer networks.
Sources: Cisco Security Advisory, Security Affairs
—
By Ji-seo Kim
