CVE-2025-20333 and CVE-2025-20362 — patched by Cisco in September 2025 — do not, according to CISA, eliminate a persistent backdoor already found running on federal networking gear.
CISA detects Firestarter on a federal network
The Cybersecurity and Infrastructure Security Agency (CISA) discovered a previously unknown implant after spotting suspicious connections on a federal civilian network that prompted a forensic investigation. CISA and the U.K. National Cyber Security Centre (NCSC) published a joint malware analysis that names the implant "Firestarter" and orders federal agencies to hunt for it.
Firestarter’s capabilities and lineage: Line Viper to persistence
The published analysis traces the activity to an initial shellcode loader the NCSC tracks as Line Viper; operators later used Firestarter as a persistence mechanism. CISA says Firestarter provides remote access and the ability to execute arbitrary code within core system processes, giving attackers control over devices that sit at the edge of federal networks and often handle sensitive traffic flows. CISA reported the implant had been deployed sometime before the end of September 2025.
Cisco patches, Arcane Door linkage, and China-nexus advisory
Cisco issued patches in September 2025 for two vulnerabilities exploited by the actors — CVE-2025-20333 and CVE-2025-20362. Cisco said the implant comes from the same threat actor the company tracks as Arcane Door, which it describes as state-sponsored activity targeting network perimeter devices. Wired, in August 2024, quoted sources asserting that Arcane Door actors are likely Chinese nation-state hackers.
Alongside its malware analysis, CISA and the NCSC published an advisory titled "defending against China-nexus covert networks of compromised devices." The reporting notes that a Chinese connection "wouldn't be a surprise," citing prior exploitation of unpatched Cisco networking gear to spy on top governmental and political targets.
CISA’s operational directive to federal agencies
CISA has directed federal agencies to assume potential compromise and to take aggressive forensic and mitigation steps. The agency instructed teams to identify all affected devices, collect system artifacts, and work with CISA on incident response and analysis. Because Firestarter can survive reboots, upgrades and standard fixes, the agency warned that devices already infected would remain compromised even after application of the September 2025 patches. CISA told agencies to treat the directive as an urgent operational requirement and to validate that remediation efforts have fully removed unauthorized access to systems.
What this means for technologists, procurement leaders, and policymakers
- Technologists and security teams: Security operators should prioritize discovery and forensic collection on Cisco Adaptive Security Appliance and Firepower devices, and assume that patched hosts may still retain persistent implants until validated clean. The advisory’s specifics — remote access and arbitrary code execution in core processes — make comprehensive artifact collection and incident-response coordination with CISA essential.
- Procurement leaders and operators of perimeter gear: Devices at the network edge that handle sensitive traffic flows are the focal point of this activity. Procurement and operations teams will need to reconcile patching timelines with deeper remediation workflows, given CISA’s finding that patches alone do not remove existing Firestarter infections.
- Policymakers and regulators: The inclusion of CVE-2025-20333 and CVE-2025-20362 in CISA’s Known Exploited Vulnerabilities catalog already triggered mandatory remediation processes; CISA’s updated guidance raises the bar by instructing agencies to assume compromise, not merely to apply patches.
The episode underscores a hard lesson in modern network defense: fixes to known vulnerabilities are necessary but not always sufficient when attackers have already established persistence. CISA’s directive converts detection into an immediate, resource-intensive hunt — one that will demand coordinated forensic work, validated remediation, and close collaboration between agencies and vendors. The joint CISA–NCSC analysis and the advisory linking the activity to Arcane Door frame the intrusion as both technically consequential and geopolitically sensitive; how thoroughly infected devices can be sanitized — and how many remain undiscovered — are the next concrete questions left by the record.
Source: govinfosecurity.com — CISA Hunts for Cisco Backdoor Spotted on Federal Network
