⚡ Weekly Recap: Firewall Exploits, AI Data Theft, Android Hacks, APT Attacks, Insider Leaks & More

Summary: Fortinet, SonicWall, Cisco, and WatchGuard all reported last week that vulnerabilities in their products were exploited in real-world attacks, including Cisco's unpatched CVE-2025-20393 in AsyncOS, which a China-nexus APT actor codenamed UAT-9686 abused to deliver malware such as ReverseSSH, Chisel, AquaPurge, and AquaShell. SonicWall said exploitation of CVE-2025-40602 in Secure Mobile Access 100 series appliances was observed alongside CVE-2025-23006 (CVSS 9.8) to achieve unauthenticated remote code execution with root privileges.
What you should know: Firewalls and edge appliances give attackers visibility into traffic, VPN connections, and downstream systems, and the Cisco flaw remains unpatched while a China-nexus APT is already using it in live attacks.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2025-11901 CVE-2025-13780 CVE-2025-14265 CVE-2025-14302 CVE-2025-14303 CVE-2025-14304 CVE-2025-14558 CVE-2025-14733 CVE-2025-20393 CVE-2025-23006 CVE-2025-32210 CVE-2025-33213 CVE-2025-33214 CVE-2025-34352 CVE-2025-37164 CVE-2025-40602 CVE-2025-40806 CVE-2025-40807 CVE-2025-46295 CVE-2025-54947 CVE-2025-59374 CVE-2025-64374 CVE-2025-64669 CVE-2025-66430 CVE-2025-68154
Related: Sonic Wall Fixes Actively Exploited CVE-2025-40602 in SMA 100 Appliances Cyber Risks ·
CVE-2025-37164: Hewlett Packard Enterprise (HPE) One View Code Injection Vulnerability Known Exploited Vulnerabilities · Jan 07, 2026
CVE-2025-14733: Watch Guard Firebox Out of Bounds Write Vulnerability Known Exploited Vulnerabilities · Dec 19, 2025