Back Technologydecisions.Au

ACSC issues High Status alert for Cisco Firepower and Secure Firewall products

Technologydecisions.Au • April 24, 2026

The Australian Cyber Security Centre (ACSC) has published a High Status alert on a previously unknown persistence mechanism that is preserved across, even when upgrading, on Cisco Firepower and Secure Firewall products running ASA or FTD software.

The alert is intended for technical teams responsible for network security, asset management and system administration in business, government and critical infrastructure sectors.

CISA and NCSC have identified new malware deployed as part of the historical exploitation of CVE-2025-20333 and CVE-2025-20362, affecting devices running Cisco Secure ASA Software or Cisco Secure FTD Software. Australian organisations can find details on this FIRESTARTER malware .

This malware can persist as an active threat on Cisco devices running ASA or Firepower Threat Defense (FTD) software, maintaining post-patching persistence and enabling threat actors to re-access compromised devices without re-exploiting vulnerabilities.

The following devices are in scope of this new malware:

Further details on the affected devices are available on the vendor advisory: Continued Evolution of Persistence Mechanism Against Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense .

ACSC advises Australian organisations to use the IOC command available in the vendor advisory .

Additionally, ASD ACSC recommends Australian organisations carry out the following steps:

If the device has not been upgraded to a release that is listed in Cisco Event Response: Continued Attacks Against Cisco Firewalls or a later release, immediately upgrade the device to prevent a potential compromise by exploitation of the referenced vulnerabilities.

Organisations that have been impacted, suspect impact or require advice and assistance can the ACSC via 1300 CYBER1 (1300 292 371) .

Image credit: iStock.com/Just_Super

Originally published here.

Entrust has enhanced its identity security platform to support phase 2 of Australia's...

KnowBe4's Agent Risk Manager solution is designed to help IT teams secure, monitor and govern...

The Australian Cyber Security Centre has released a high priority alert regarding the ongoing...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies A sophisticated backdoor malware named Firestarter has been discovered on Cisco Firepower devices, attributed to the state-sponsored threat actor UAT-4356. The malware exploits two vulnerabilities, CVE-2025-20333 and CVE-2025-20362, which were patched in September 2025 but remain exploitable if devices were compromised prior to patching. Firestarter allows attackers to maintain persistent access even after firmware updates and standard reboots by manipulating the Cisco Service Platform mount list. The Cybersecurity and Infrastructure Security Agency (CISA) confirmed the presence of Firestarter on a U.S. federal agency's device, prompting an emergency directive for all federal civilian agencies to audit their Cisco firewall infrastructure. The malware can execute arbitrary code and has been linked to a broader campaign targeting government and critical infrastructure networks. Organizations are advised to conduct thorough security checks and utilize YARA rules for detection. The incident highlights the ongoing risks associated with unpatched vulnerabilities and the need for robust cybersecurity measures. 37 sources 79

Extracted Entities

ACSC issues High Status alert for Cisco Firepower and Secure Firewall products

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Industries (1)

Malware (1)

Platforms (3)