---
title: Cisco ASA Zero-Day Exploited by Chinese State Hackers in Critical Infrastructure Attacks
description: Chinese hackers exploit critical Cisco firewall flaw, CVE-2025-20333, demanding urgent patching by federal agencies in a global threat.
canonical_url: https://codekeeper.co/ticker/chinese-hackers-exploit-cisco-asa-zero-day
---

# Cisco ASA Zero-Day Exploited by Chinese State Hackers in Critical Infrastructure Attacks

Chinese hackers exploit critical Cisco firewall flaw, CVE-2025-20333, demanding urgent patching by federal agencies in a global threat.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 29, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Chinese state-sponsored hackers have actively exploited CVE-2025-20333, a devastating zero-day vulnerability in Cisco ASA firewalls with a 9.9 severity score. The flaw allows remote code execution with root privileges when chained with another vulnerability that bypasses authentication. The UAT4356 threat group deployed sophisticated malware called RayInitiator and LINE VIPER on compromised Cisco ASA 5500-X Series devices. RayInitiator persists at the firmware level, surviving reboots and updates, while LINE VIPER provides command and control capabilities through encrypted communications. CISA issued Emergency Directive ED-25-03 requiring federal agencies to patch within 24 hours or disconnect affected devices. This represents a major evolution of the ArcaneDoor campaign, targeting critical network perimeter defenses worldwide. **Source:** [Cybersecurity News](https://cybersecuritynews.com/lessons-cisco-asa-0-day-rce-vulnerability/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-cisco-asa-zero-day%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[![FBI arrests Canadian in Pennsylvania linked to ShinyHunters hack, part of efforts to dismantle the group after breaching FBI data.](https://codekeeper.co/hubfs/_sized/Generated%20Blog%20Post%20Images/fbi-arrests-canadian-in-shinyhunters-hack-800.png) Cyberattacks New Arrest in the Hunt for the FBI Jobs Site Hackers Oct 12, 2026](https://codekeeper.co/ticker/fbi-arrests-canadian-in-shinyhunters-hack)

[PoC Claims Zero-Day Privilege Escalation in Kaspersky Endpoint Security Sep 1, 2026](https://codekeeper.co/ticker/kaspersky-zero-day-claim-windows11)

[Cyberattacks Jordan Detains Alleged ShinyHunters Leader Oct 6, 2026](https://codekeeper.co/ticker/teen-hacker-rey-arrested-cooperates-with-fbi)

[Software security One POST Request Can Freeze a Next.js Server Oct 12, 2026](https://codekeeper.co/ticker/react-vulnerability-freezes-nextjs-servers)