ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
blog.talosintelligence.com · 24 Apr 2024 · Licence: not cleared; local research copy only
CVEs this report names
7 CVEs- CVE-2024-20353Cisco ASA and FTD Denial of Service VulnerabilityCisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVPublic exploitHigh · 8.6T1608.001Upload MalwareT1190Exploit Public-Facing Application+2 more · 2 reports69.8%Top 0.63%85.0priority
- CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · Catalyst SD-WANKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application4 reports91.8%Top 0.18%83.9priority
- CVE-2024-20359Cisco ASA and FTD Privilege Escalation VulnerabilityCisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVPublic exploitMedium · 6.0T1078Valid AccountsT1059Command and Scripting Interpreter+1 more · 2 reports18.8%Top 2.7%82.8priority
- CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitCritical · 9.9T1133External Remote ServicesT1059Command and Scripting Interpreter5 reports71.2%Top 0.59%79.8priority
- CVE-2025-20362Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation5 reports87.1%Top 0.25%79.0priority
- CVE-2025-20363A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure…Cisco · IOSCritical · 9.02 reports6.9%Top 5.9%67.3priority
- CVE-2018-0101A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA)…Public exploit1 report86.8%Top 0.26%64.9priority
Where it names them
CVE-2024-20353 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
While we have been unable to identify the initial attack vector, we have identified two vulnerabilities (CVE-2024-20353 and CVE-2024-20359), which we detail below.
Cisco has identified two vulnerabilities that were abused in this campaign (CVE-2024-20353 and CVE-2024-20359).
In at least one case, there is another vulnerability, CVE-2024-20353, that was abused by the actor to facilitate this process.
CVE-2024-20353 (ASA DOS/Reboot) - 3:63139
The reboot action via CVE-2024-20353 (T1653),
CVE-2026-20182 Original (opens in a new tab) ↗
Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.
CVE-2024-20359 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
While we have been unable to identify the initial attack vector, we have identified two vulnerabilities (CVE-2024-20353 and CVE-2024-20359), which we detail below.
Cisco has identified two vulnerabilities that were abused in this campaign (CVE-2024-20353 and CVE-2024-20359).
This is assigned CVE-2024-20359 and more details are available in this Cisco Security Advisory.
After updating the device to a software release that contains the fix for CVE-2024-20359, a review of the contents of disk0: should be conducted.
Note that because the updated software is not vulnerable to CVE-2024-20359, Line Runner will no longer be active on the device.
CVE-2025-20333 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
*Update 2025-09-25: Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
CVE-2025-20362 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
*Update 2025-09-25: Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
CVE-2025-20363 Original (opens in a new tab) ↗
*Update 2025-09-25: Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.
CVE-2018-0101 Original (opens in a new tab) ↗
Note that the use of this field does not indicate the exploitation of CVE-2018-0101 which was NOT used as a component of this campaign.
Techniques drawn from this report
1 link, in kill-chain orderPersistence Power Settings T1653 for CVE-2024-20353
MITRE CTID mapping of the KEV entry
The reboot action via CVE-2024-20353 (T1653),