FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches

FIRESTARTER is a backdoor malware targeting Cisco ASA and Firepower devices that persists through firmware patches by manipulating the device's boot sequence.

• •The malware exploited CVE-2025-20333 (CVSS 9.9) and CVE-2025-20362 (CVSS 6.5) vulnerabilities in Cisco networking devices
• •FIRESTARTER survives firmware updates and device reboots unless a hard power cycle occurs by lodging itself into the boot sequence
• •The malware is deployed with LINE VIPER post-exploitation toolkit that executes CLI commands and bypasses VPN authentication
• •Cisco recommends reimaging and upgrading affected devices, with cold restart and physical power disconnection required for full removal
• •The attack campaign is attributed to China-affiliated APT actors using compromised SOHO routers and IoT devices as proxy networks