WebVPN
Cisco's clientless web-based VPN access path exploited by UAT-4356 for FIRESTARTER initial access via CVE-2025-20333.
Last refreshed: 30 April 2026 · Appears in 1 active topic
Does patching WebVPN vulnerabilities remove persistent implants already inside the device?
Timeline for WebVPN
Mentioned in: FIRESTARTER implant survives every Cisco firewall patch
Cybersecurity: Threats and DefencesMentioned in: Federal agency stayed compromised six months
Cybersecurity: Threats and Defences- What is Cisco WebVPN?
- Clientless remote-access VPN technology that runs through a web browser on Cisco ASA and Firepower appliances, used when VPN client software cannot be installed.Source: Cisco
- How does FIRESTARTER exploit WebVPN?
- UAT-4356 chains CVE-2025-20333 and CVE-2025-20362 in the WebVPN authentication layer for initial access, then deploys FIRESTARTER implant that persists below the patch layer.Source: CISA AR26-113A
- Can patching fix a WebVPN compromise?
- Patching WebVPN vulnerabilities does not remove FIRESTARTER if the implant has already hooked the device boot sequence. An unnamed federal agency remained compromised six months after patching in September 2025.Source: CISA/NCSC
Background
WebVPN is Cisco's branded clientless remote-access offering on ASA and Firepower appliances. Unlike traditional VPN clients that require software installation on the user's laptop, WebVPN runs through a web browser, making it the entry point for users who cannot install client software or who use highly restricted devices. The technology has been part of the Cisco adaptive security appliance ecosystem since ~2005-era releases, making it a fixture in enterprise perimeter design for 20 years.
On 23 April 2026, CISA and NCSC disclosed that UAT-4356 exploited WebVPN authentication logic to trigger the FIRESTARTER implant already resident on the device . The attack chain begins with CVE-2025-20333, a Remote Code Execution flaw in WebVPN authentication handling, followed by CVE-2025-20362, a privilege-escalation vulnerability. An unnamed federal agency patched both vulnerabilities in September 2025 but remained compromised six months later , because FIRESTARTER had already hooked the device boot sequence before the patches deployed. WebVPN's accessibility (no client software required) makes it the primary ingress point for remote-access compromises, and the FIRESTARTER advisory treats it as an attack surface that persists through patching.