HIGH ALERT: New steps for organisations running Cisco Firepower and Secure Firewall products

This advisory from ASD/ACSC (citing CISA and NCSC) warns of FIRESTARTER malware that maintains persistence on Cisco Secure ASA and Firepower/FTD devices—surviving upgrades and enabling re-access after patching via historical exploitation of CVE-2025-20333 and CVE-2025-20362. The alert lists affected Firepower and Secure Firewall series, directs operators to vendor advisories and detection commands (IOC, show checkheaps, show tech-support detail), recommends generating core dumps and running provided YARA rules, and instructs impacted organisations to report incidents and upgrade devices to patched releases.