Is my Cisco ASA or Firepower VPN login a risk?

What is a Cisco ASA VPN login?

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability 2025-09-25 Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution.

Cisco Adaptive Security Appliance (ASA) and Firepower devices are firewalls that also let staff connect to the office by VPN. The VPN sign-in page faces the internet by design.

Why does it matter?

CISA analysis determines that applying the Cisco-provided security updates required by the original issuance of ED 25-03 does not necessarily remove an existing threat actor from the compromised device.

CISA added the two flaws to its catalog of exploited flaws on 25 September 2025, the day it issued Emergency Directive 25-03. One allows remote code execution through the VPN web server.

Is a restart enough after updating?

Perform a hard reset of the device(s) by physically unplugging the device's power supply, as a reboot is not sufficient to expunge the malware, no later than April 30, 2026.

No. In its update of 23 April 2026, CISA told agencies to unplug the device's power supply for a hard reset, because a reboot does not remove the malware.

What do I do about it?

1. Install Cisco's latest fixed software on the device.
2. After updating, do a hard reset by unplugging the power, as CISA describes.
3. Replace ASA hardware that has reached end of support.
4. Change the passwords and keys used by the VPN.