Cisco ASA Zero-Day Exploited by Chinese State Hackers in Critical Infrastructure Attacks

Chinese hackers exploit critical Cisco firewall flaw, CVE-2025-20333, demanding urgent patching by federal agencies in a global threat.

By Content Team

Sep 29, 2025

ON THIS PAGE

Chinese state-sponsored hackers have actively exploited CVE-2025-20333, a devastating zero-day vulnerability in Cisco ASA firewalls with a 9.9 severity score. The flaw allows remote code execution with root privileges when chained with another vulnerability that bypasses authentication.

The UAT4356 threat group deployed sophisticated malware called RayInitiator and LINE VIPER on compromised Cisco ASA 5500-X Series devices. RayInitiator persists at the firmware level, surviving reboots and updates, while LINE VIPER provides command and control capabilities through encrypted communications.

CISA issued Emergency Directive ED-25-03 requiring federal agencies to patch within 24 hours or disconnect affected devices. This represents a major evolution of the ArcaneDoor campaign, targeting critical network perimeter defenses worldwide.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?