FIRESTARTER Malware affecting Cisco ASA and FTD

The NCSC would like to draw your attention to FIRESTARTER, malware that allows remote access and control by malicious threat actors targeting Cisco Firepower and Secure Firewall products with Adaptive Security Appliance (ASA) or Firewall Threat Defence (FTD) software. 

The following vulnerabilities have been associated with the method by which an advanced persistent threat actor gained initial access to deploy FIRESTARTER on Firepower and Secure Firewall devices: 

• CVE-2025-20333 (CVSS 9.9): A vulnerability in the VPN web server of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.  
• CVE-2025-20362 (CVSS 6.5): A vulnerability in the VPN web server of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to access restricted URL endpoints without authentication that should otherwise be inaccessible without authentication.

Note: If a Cisco device was running vulnerable software prior to applying the patch for CVE-2025-20333 and CVE-2025-20362, there is a possibility FIRESTARTER malware is present.