top of page
Search

URGENT MANDATE: Why Your Procurement Team Must Immediately Retire Older Cisco ASA Firewalls



A Critical Security Flaw Is Now a Procurement Priority

For months, advanced threat actors—likely tied to the infamous ArcaneDoor campaign—have continued a sustained, zero-day attack against a specific set of aging network security hardware.

This is not a vulnerability IT can patch its way out of. This is a procurement crisis demanding immediate asset retirement and secure replacement. Procurement and supply chain leaders must understand the risk and ensure these vulnerable models are removed from active service now.

Mike Gropp, a senior cybersecurity adviser, captured the severity perfectly when he described the attack as "a front door breaking on the very devices that guard corporate and government networks." The devices "sit at the edge of thousands of Canadian organizations," including banks, hospitals, utilities, and public agencies, which are now all exposed.


The Risk: Persistent, Evasive Compromise

The attacks primarily target specific older Cisco ASA models running certain software releases with VPN web services enabled. The objective is not just disruption, but deep, persistent compromise:

  • Advanced evasion: Attackers are using sophisticated methods, including disabling logging and intentionally crashing devices, to prevent forensic analysis.

  • Deep persistence: The threat actor has been observed modifying ROMMON (the low-level boot firmware) to maintain access even across reboots and major software upgrades. This means the compromise is virtually permanent.

  • The objective: Implanting malware, executing commands, and potentially exfiltrating sensitive corporate data.

  • Scope of exposure: A successful compromise can “silently monitor, steal or reroute all the traffic that flows through them” and “expose things like patient records, financial data, or even government communications and disrupt essential services” (CBC News, 2025).

  • Likely actors: Experts suggest the techniques align with the modus operandi of a state-sponsored attacker, likely China or Russia, who prioritize stealth and persistence to gain geopolitical leverage (CBC News, 2025).


The Procurement Mandate: Retire These Models Now

The good news is that the vulnerability is limited to older hardware that lacks modern security architecture.

The following older Cisco ASA 5500-X Series models have been successfully compromised and must be decommissioned immediately:

CIsco image showing older Cisco ASA 5500-X Series models that have been successfully compromised and must be decommissioned immediately

Resource List

  1. CISA. 2025. “Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices.” U.S. Cybersecurity and Infrastructure Security Agency. Published September 24, 2025. https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices

  2. Cisco Systems. 2025. “Continued Attacks Against Cisco Firewalls.” Cisco Security Center. Published September 25, 2025.  https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks


Author Profile & Related Content

Laura V. Garcia is a leading B2B content strategist specializing in supply chain risk management, procurement best practices, and the integration of emerging technologies. Her analysis focuses on bridging the gap between strategic defense policy and commercial logistics operations.

  1. Articles and Resources by Laura V. Garcia https://resources.altium.com/experts/laura-garcia

  2. Laura V. Garcia | B2B & Supply Chain Content Writer https://www.lauravgarcia.ca

  3. Supply Chain Visibility: Data and Analytics https://america.cjlogistics.com/newsroom/2021/05/supply-chain-visibility-data-and-analytics/

  4. Laura V. Garcia – Supply Chain Digital https://supplychaindigital.com/author/laura-v-garcia

  5. Laura V. Garcia – Business Chief Asia https://businesschief.asia/author/laura-v-garcia

  6. Laura V. Garcia – Procurement Magazine https://procurementmag.com/author/laura-v-garcia

  7. Smarter Design Choices with Up-to-Date Component Pricing and Data (Octopart) https://octopart.com/pulse/p/smarter-design-choices-component-pricing-and-data

  8. Laura V. Garcia – Supply Chain Magazine https://supplychaindigital.com/author/laura-v-garcia/all

  9. Laura V. Garcia - LinkedIn Profile https://ca.linkedin.com/in/laura-v-garcia

Comments

bottom of page