Cisco warns of ‘ArcaneDoor’ zero-day vulnerability in ASA firewalls

Attackers are exploiting software vulnerabilities in some Cisco Adaptive Security Appliance (ASA) or Cisco Firepower Threat Defense (FTD) devices to inject malware and potentially exfiltrate data, according to Cisco Talos.

The campaign, dubbed ArcaneDoor, exploits two documented software vulnerabilities (CVE-2024–20353 and CVE-2024–20359) in Cisco products. However, experts are still unsure how the attackers got into the system.

„We have not determined the original access vector used in this campaign. We have not yet found evidence of unauthenticated exploits,“ Cisco Talos said.

Cisco said an unnamed customer reported „security concerns“ in ASA firewall products to its PSIRT team in early 2024, triggering an investigation that led to the discovery of the attacker (tracked as UAT4356 by Talos and STORM-1849 by the Microsoft Threat Intelligence Center).

„This attacker used custom tools that showed a clear focus on espionage and intimate knowledge of the targeted devices, which are hallmarks of a sophisticated state-sponsored attack,“ Cisco said.

Cisco noted that the hacking team deployed two backdoors used for configuration modification, reconnaissance, network traffic exfiltration and potentially lateral movement in the network.