Hackers Exploit Cisco Firepower Devices Using N-Day Vulnerabilities to Gain Unauthorized Access

A state-sponsored actor tracked as UAT-4356 is actively exploiting two known Cisco FXOS vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to deploy the FIRESTARTER backdoor on Cisco ASA/FTD/Firepower appliances by injecting shellcode into the LINA process and replacing a WebVPN XML handler; persistence is achieved via CSP_MOUNT_LIST modification and copying to /opt/cisco/... with indicators (file paths, process checks, ClamAV signature, Snort rules) and mitigations (apply Cisco patches, reimage compromised devices, terminate lina_cs and reload non-lockdown FTD, and follow CISA ED 25-03) provided.