Temporary Risk Mitigation Guidance for Agencies in the Process of ED 25-03 Compliance

This document provides temporary risk mitigation instructions for agencies that are in the process of complying with Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices.

The recommendations contained herein are not a substitute for agency compliance with ED 25-03. Instead, CISA recommends that agencies temporarily carry out these steps in parallel with their ED 25-03 compliance efforts in order to best mitigate risk to federal information systems. Agencies that are already fully compliant with ED 25-03 need not carry out these steps.

If agencies have questions about implementing steps in this guidance, please contact CISA at contact@cisa.dhs.gov. If, as a result of following the actions below, indicators of compromise are detected, please report them to: contact@cisa.dhs.gov.

Unpatched Device Guidance

Due to ongoing and new activity from Threat Actors, CISA recommends the following actions for all public-facing Cisco ASA platforms and all public-facing Cisco Firepower Threat Defense appliances that remain unpatched for CVE-2025-20333 and CVE-2025-20362. CISA recommends agencies confirm WebVPN services are not enabled for additional validation that a device is not public-facing.

Examine the running and startup configurations for any unauthorized changes once a day.
1. Newly created or unfamiliar user accounts.
2. Alterations to the AnyConnect WebVPN client configuration.
3. Modifications that add services or lower the security boundary (SSH vs Telnet), weak SNMP configurations (e.g. SNMPv3 without Priv and Auth settings set and any version below v3).
4. Any IPSec tunnels or site-to-site VPNs unfamiliar to the organization.
Run the command: show checkheaps every 4 hours.
1. Confirm and notate the time of the last successful checkheaps command.
2. Copy the output and save it to a location separate from the Cisco device, preferably on a system that is isolated from the rest of the network.
3. Wait 5 or more minutes and run the command again. Look specifically at the return in the last row, which indicates (“Total number of runs”).
4. It should increase by 1 every 60 seconds for the time period between the checks you perform (i.e., if the command is executed five minutes apart, the number should increase by approximately five).
5. Note the number reflected and whether there was an increase.
6. If there was no observable positive change in the “Total number of runs” value, this is evidence of a potential compromise.
Continuously examine syslog events related to login events.
1. Review the following Message IDs in syslog from the appliance to monitor and hunt for impossible travel/logon activity.
  1. For information level syslogs:
    1. WebVPN session terminated: Idle Timeout : %ASA-6-716002
  2. For debug level syslogs:
    1. SVC Service Termination: %ASA-7-722029
    2. SVC Service Termination: %ASA-7-722030
    3. SVC Service Termination: %ASA-7-722031
  3. Note: Informational level syslogs should be enabled by default (if they have been disabled, CISA recommends enabling them). Debug level syslogs are not enabled by default, though, and network defenders should consider enabling them, if manageable.
Review the customization settings for Cisco AnyConnect WebVPN clients once a day.
1. Search for customizations to the Cisco AnyConnect client by running the following command:
  1. show import webvpn AnyConnect-customization
2. Search the output for references to .pdf and .bat files that cannot be validated as legitimate by the organization.
Continuously examine syslog events related to command execution.
1. Review logs from the device, preferably from an external log repository like Splunk or other SIEM. Examine syslog events related to command execution. Message IDs to look for are as follows:
  1. Message ID 111009: %ASA-7-111009: User 'user' executed cmd: string
  2. Message ID 111010: %ASA-5-111010: %ASA-5-111008: User 'user' executed the 'string' command.
  3. Message ID 111008: %ASA-5-111008: User, running application-name from IP, executed cmd.
2. An example of a command to hunt for is:
  1. "import webvpn anyConnect-customization"
3. This will cover the more specific command of "import webvpn anyConnect-customization type binary platform win name example.bat disk0:/example.bat"
Search Disk0 for targeted files once a day.
1. Pull a listing: Run the following command to pull all active contents from disk0, conduct a review of the listed files for any .pdf or .bat files from the previous step.
  1. dir /recursive disk0:
2. If the organization has the means to acquire the eUSB from the ASA, a search for deleted items in unallocated space is recommended.
3. A more verbose version of the command that will include disk0 and any additional filesystems present on the device is:
  1. dir /recursive all-filesystems

Unpatched Cisco ASA 5500-X Series Appliances

In addition to the actions above, CISA recommends that agencies take the following actions for unpatched public-facing Cisco ASA 5500-X appliances that do not have secure boot capabilities and are hosting WebVPN services. Those models include, but are not limited to, 5555-X, 5545-X, 5525-X, and 5585-X.

Collect a core dump and submit it to Malware NextGen for processing once a day, prior to 1200 Local Time.
1. For step-by-step guidance please follow Part 1 and Part 2 of the Core Dump and Hunt Instructions for ED 25-03.
Run the following command to check for the presence of the threat actor’s implant every 4 hours:
1. more /binary system:/text | grep 55534154 41554156 41575756 488bb3a0
2. Save the output in a location separate from the Cisco device, preferably on a system that is isolated from the rest of the network.
3. If you receive any output from running this command, it means the device has been compromised.
Run the checkheaps command as described below every 4 hours:
1. show checkheaps
2. Confirm and notate the time of the last successful checkheaps command.
3. Copy the output and save it to a location separate from the Cisco device, preferably on a system that is isolated from the rest of the network.
4. Wait 5 or more minutes and run the command again. Look specifically at the return in the last row, which indicates (“Total number of runs”).
5. It should increase by 1 every 60 seconds for the time period between the checks you perform (i.e., if the command is executed five minutes apart, the number should increase by approximately five).
6. Note the number reflected and whether there was an increase.
7. If there was no observable positive change in the “Total number of runs” value, this is evidence of a potential compromise.

Recently Patched Device Guidance

For all public-facing devices that were patched after September 26, 2025, the deadline specified in ED 25-03, CISA recommends the following actions:

Review the customization settings for Cisco AnyConnect WebVPN clients.
1. Search for customizations to the Cisco AnyConnect client by running the following command:
  1. show import webvpn AnyConnect-customization
2. Search the output for references to .pdf and .bat files that cannot be validated as legitimate by the organization.
Examine syslog events related to command execution.
1. Review logs from the device, preferably from an external log repository like Splunk or other SIEM. Examine syslog events related to command execution. Message IDs to look for are as follows:
  1. Message ID 111009: %ASA-7-111009: User 'user' executed cmd: string
  2. Message ID 111010: %ASA-5-111010: %ASA-5-111008: User 'user' executed the 'string' command.
  3. Message ID 111008: %ASA-5-111008: User, running application-name from IP, executed cmd.
2. An example of a command to hunt for is:
  1. "import webvpn anyConnect-customization"
3. This will cover the more specific command of "import webvpn anyConnect-customization type binary platform win name example.bat disk0:/example.bat"
Search Disk0 for targeted files.
1. Pull a listing: Run the following command to pull all active contents from disk0.
  1. dir /recursive disk0:
2. Search the output for references to .pdf and .bat files that cannot be validated as legitimate by the organization.
3. If the organization has the means to acquire the eUSB from the ASA, a search for deleted items in unallocated space is recommended.
4. A more verbose version of the command that will include disk0 and any additional filesystems present on the device is:
  1. dir /recursive all-filesystems
5. Search the output for references to .pdf and .bat files that cannot be validated as legitimate by the organization.