ROM Monitor (ROMmon)

Tool

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

November 6, 2025

Last Seen

November 6, 2025

API

ROM Monitor (ROMmon) is Cisco’s bootstrap/ROM Monitor mode on Cisco devices, a low-level recovery environment used for device maintenance and recovery when the normal operating system cannot boot.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (2)

Cisco Warns of New Attack Variant Targeting Firewalls

Nov 6·4 sources

Cisco Firewalls Targeted by New Attack Variant Exploiting Critical Vulnerabilities

Nov 14·20 sources

Related Entities

ArcaneDoor DDoS Zero-day Exploit Government Cisco Secure ASA Software Cisco Secure FTD Software Cisco Unified CCX Cisco Unified Center Express (UCCX)

ROM Monitor (ROMmon)

Overview

Recent Events

Profile

Used By

Attack Types

Platforms

Sectors Targeted

Relationships

Related Clusters (2)

Cisco Warns of New Attack Variant Targeting Firewalls

Cisco Firewalls Targeted by New Attack Variant Exploiting Critical Vulnerabilities

Related Articles (1)

Cisco warns of 'new attack variant' battering firewalls under exploit for 6 months

Related Entities