Vulnerable Cisco Adaptive Security Appliance and Firewall Threat Defense devices impacted by the CVE-2025-20333 and CVE-2025-20362 flaws have been targeted with a new wave of intrusions since May, reports The Register .
Attacks aimed at impacted firewalls prompted persistent reloads that subsequently led to denial-of-service conditions, according to an updated alert from Cisco, which linked the illicit activity and intrusions to the ArcaneDoor threat operation . Such a development comes as the firm issued fixes for a pair of critical issues affecting its Unified Center Express software.
More severe of the two is the improper authentication mechanism-linked Java Remote Method Invocation process bug, tracked as CVE-2025-20354, which could be leveraged to facilitate arbitrary code execution on the operating system and privilege escalation to root.
On the other hand, exploitation of the authentication bypass defect CVE-2025-20358, which stems from improper CCX Editor and Unified CCX server authentication, could prompt arbitrary script execution. No active exploitation of either flaw has been observed so far.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
