Prepared by: Adam Skupien, Vulnerability Security Analyst | Published: Fri 24 April 2026
The purpose of this alert is to highlight newly disclosed information relating to persistent malware associated with the historical exploitation of CVE‑2025‑20333 and CVE‑2025‑20362 in Cisco Secure Firewall and Firepower devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software.
CVE‑2025‑20333 is rated Critical by Cisco. CVE‑2025‑20362 is rated Medium, with Cisco citing no direct impact to availability; however, the U.S. National Vulnerability Database (NVD) assigns a High CVSS score based on potential availability impact in broader exploitation scenarios.
Although these vulnerabilities were publicly disclosed and patches were released in September 2025, subsequent Cisco analysis, supported by findings from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.K. National Cyber Security Centre (NCSC) has confirmed that devices compromised prior to patching may remain compromised even after upgrading to fixed releases. The malware, tracked as FIRESTARTER, enables persistent, unauthorised access without the need to re‑exploit the original vulnerabilities.
On 23 April 2026, Cisco released an informational advisory describing a previously undocumented persistence mechanism used by the threat actor associated with the ArcaneDoor campaign, tracked by Cisco as UAT‑4356. This persistence mechanism resides within the Cisco Firepower eXtensible Operating System (FXOS) and survives software upgrades applied after the September 2025 vulnerability disclosures.
The Australian Cyber Security Centre (ACSC) has acknowledged the updated threat information and advised Australian organisations to follow Cisco’s guidance and check for published indicators of compromise (IoCs).
Vendor analysis has identified the malware implant as FIRESTARTER, which:
lina_csImportantly, while upgrading to fixed software versions prevents new exploitation of CVE‑2025‑20333 and CVE‑2025‑20362, patching alone does not remove FIRESTARTER on devices that were compromised prior to remediation.
The following platforms are affected regardless of configuration:
The following platforms are not affected by this persistence mechanism:
As no standalone software update exists to remove the FIRESTARTER persistence mechanism, organisations operating the affected platforms should ensure the detection and mitigation steps outlined below are performed to validate device integrity and identify potential compromise.
Successful exploitation resulting in a persistent FIRESTARTER implant compromises the trust boundary of affected Cisco Secure Firewall and Firepower devices.
If present, the malware enables a threat actor to maintain ongoing, unauthorised access to a network perimeter device, which may allow:
Because affected devices typically operate with elevated privileges and are positioned at critical network boundaries, compromise may undermine the confidentiality and integrity of network traffic and security controls reliant on the appliance.
Organisations should assess historically exposed devices for signs of compromise.
Cisco has identified a single reliable IoC for the FIRESTARTER implant, which can be checked by running the following command from the device command‑line interface (CLI):
show kernel process | include lina_cs
Additional investigation may include collection of diagnostic outputs such as show tech-support detail and memory analysis, consistent with vendor guidance. The ACSC advises organisations to use the IoCs published by Cisco and follow vendor‑provided investigation guidance.
If the IoC is present, the device must be considered untrusted.
Cisco advises that full remediation requires:
Cisco notes that a cold power removal (unplugging the device from power) may interrupt the persistence mechanism but does not recommend this as a substitute for reimaging as it may cause data corruption. Organisations should follow Cisco guidance to ensure integrity is restored.
Where malware is identified, organisations should manage the issue in accordance with their established incident response processes. While U.S. government agencies are subject to separate directives, the technical findings and vendor guidance are applicable more broadly.
Customers with Monitor (24x7x365 Managed Detection and Response) services continue to be monitored for indicators associated with this activity and for anomalous behaviour involving perimeter security devices.
Customers who have identified the FIRESTARTER indicator of compromise, or who require assistance validating the integrity of affected devices, are encouraged to engage Triskele Labs for tailored incident response and remediation support.
References