Cisco recommends checking the appliance’s system logs for indicators of compromise using the command grep “System Security” system_logs. However, a clean result should not replace broader investigation: the vendor advises administrators to cross-check external network and firewall logs for suspicious traffic, including unexpected uploads from affected appliances or downloads from malicious IP addresses.
Patches are available, but incident response matters
Cisco lists AsyncOS 15.5.5-014 and 16.5.0-780 as fixed releases for the corresponding software branches. Customers on AsyncOS 16.0 are advised to migrate to a fixed release. The vendor also said the fix is available through Content Scanner Tools version 25.3.0.5525 and later, and that updating the tools does not require a software upgrade or appliance restart.
For potentially compromised virtual appliances, Cisco recommends preserving forensic evidence before rebuilding the system, deploying a clean virtual machine, rebuilding its configuration without importing previous configuration files, and renewing credentials and cryptographic materials.
