The Cybersecurity and Infrastructure Security Agency (CISA) has issued Emergency Directive 25-03, requiring all U.S. federal agencies to urgently identify, analyze, and mitigate potential compromises of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower devices following the discovery of a sophisticated exploitation campaign.

The directive, signed under the authority of 44 U.S.C. § 3553(h), marks one of the most serious hardware-level cyber incidents affecting government infrastructure this year.

Background: A Persistent and Deep-Seated Threat

CISA confirmed ongoing exploitation activity by a state-sponsored threat actor leveraging zero-day vulnerabilities in Cisco ASA systems to achieve unauthenticated remote code execution and persistent access through ROM manipulation — a rare and advanced technique that survives system reboots and firmware upgrades.

The campaign, which CISA associates with the ArcaneDoor activity uncovered in 2024, targets edge network firewalls widely deployed across federal, defense, and critical-infrastructure networks.

Cisco identified two high-impact vulnerabilities actively exploited in this campaign:

• CVE-2025-20333 — Remote Code Execution
• CVE-2025-20362 — Privilege Escalation

According to Cisco and CISA analysis, these flaws allow attackers to implant malicious code into read-only memory, effectively transforming network appliances into long-term espionage footholds.

Mandatory Federal Actions

Under the directive, all federal agencies must take the following actions immediately:

1. Inventory all affected assets:
   Identify every Cisco ASA (hardware, ASAv, ASA-SM) and Firepower Threat Defense (FTD) instance across the network, including virtual deployments.
2. Perform forensic collection:
   Execute the CISA Core Dump and Hunt procedure and upload core dumps to the Malware Next Gen portal by September 26, 2025, 11:59 PM EDT.
3. Respond to compromise findings:
   • If compromise is detected, disconnect the device (without powering it off), report immediately to CISA, and coordinate eviction.
   • If no compromise is detected, proceed with mandatory patching and reporting steps.
4. Decommission legacy platforms:
   • End-of-Support (EoS) ASA devices (EoS ≤ Sept 30 2025) must be permanently removed from service.
   • Devices with EoS = Aug 31 2026 must apply all Cisco patches and future updates within 48 hours of release.
5. Upgrade supported systems:
   All remaining ASAv and Firepower devices must be updated to the latest firmware versions by Sept 26, 2025, and maintained with rapid patching thereafter.
6. Comprehensive reporting:
   Agencies must submit a full inventory and mitigation status report to CISA by October 2, 2025, using the provided template.

These directives extend to federal systems operated by third parties or within FedRAMP-authorized cloud environments, making compliance a shared responsibility between agencies and service providers.

Technical & Strategic Implications

This incident underscores a growing threat trend: firmware-level and ROM-based persistence on network perimeter devices. Such attacks bypass traditional detection, survive firmware updates, and allow deep, long-term espionage access.

For CISOs and enterprise defenders outside the federal sector, this directive carries critical lessons:

• Asset Visibility Is Non-Negotiable: Know every device version and patch state at the network edge.
• Firmware Integrity Monitoring: Treat hardware ROM validation as part of standard security audits.
• Zero-Trust Network Boundaries: Assume firewall compromise is possible; limit implicit trust zones.
• Vendor Lifecycle Awareness: End-of-support network gear must be decommissioned or fully isolated.
• Threat Hunting Beyond Logs: Memory dumps, ROM hashes, and firmware comparisons are now part of modern incident response.

Key Takeaways for CISOs

Outlook

Emergency Directive 25-03 may represent a turning point in federal network hardening — emphasizing firmware integrity, lifecycle management, and continuous monitoring beyond software vulnerabilities.
Private enterprises, especially those relying on Cisco ASA and Firepower architectures, should mirror federal mitigation steps without delay.

Persistent manipulation of network ROM components demonstrates that nation-state actors are now fully capable of embedding at the hardware level.
This elevates the conversation from patch management to resilient infrastructure trust — a priority that every CISO should address before adversaries do.

References:

• CISA Emergency Directive 25-03 – Identify and Mitigate Potential Compromise of Cisco Devices
• Cisco Security Advisories, September 2025
• CISA Supplemental Direction 25-03 – Core Dump and Hunt Instructions