25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming

Summary: GreyNoise observed more than 25,000 unique IPs scanning Cisco ASA devices in a single late-August burst, against a baseline of under 500 IPs per day, with a smaller related surge days later. Cisco then disclosed two zero-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362, both added to CISA's KEV catalog, and CISA issued Emergency Directive ED 25-03 requiring federal agencies to apply mitigations within 24 hours.
What you should know: This is only the third emergency directive in CISA's history, and the scanning that preceded the disclosure was dominated by a single Brazil-concentrated botnet cluster whose client fingerprint was used exclusively against Cisco ASA devices.

Read the original at GreyNoise Blog ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2025-20333 CVE-2025-20362
Related: Threat Insights: Active Exploitation of Cisco ASA Zero Days Cyber Risks ·
Arcane Door - New espionage-focused campaign found targeting perimeter network devices Cyber Risks ·
UAT-4356's Targeting of Cisco Firepower Devices Cyber Risks ·