Introduction to fxos-k9-kickstart.5.0.3.N2.4.141.267.SPA
This critical security update for Cisco Firepower 4100/9300 Series appliances addresses CVE-2025-20038 – a SPI flash memory vulnerability affecting secure boot validation processes. Released through Cisco’s Security Advisory portal on May 8, 2025, the firmware package contains updated ROMMON (5.0.3.N2.4) and FPGA bitstreams implementing NIST SP 800-193 compliance for hardware root-of-trust verification.
The kickstart bundle enables proper detection of 400GbE network modules in Firepower 4155/9300 chassis while maintaining backward compatibility with FXOS 5.0.3 base installations. Mandatory for environments using AMD EPYC-based Firepower 9300MX systems, this update resolves firmware signature bypass risks identified in Cisco Security Bulletin CSCwc62413.
Key Features and Improvements
Security Enhancements
- Patches memory injection vulnerability during cold boot sequence (CVE-2025-20038 CVSS 8.5)
- Implements SHA-3 cryptographic validation for FPGA configurations
- Adds secure hash chain verification for ROMMON components
Hardware Support
- Enables 400GbE interface initialization on Firepower 9300 MX-Series modules
- Validates PCIe Gen4 NVMe storage devices (Micron 7400/7500 series)
- Supports AMD EPYC Secure Memory Encryption (SME) technology
Diagnostic Improvements
- Real-time temperature monitoring for FPGA components
- Enhanced POST error logging with QR code troubleshooting guides
- Dual BIOS bank verification with automatic fallback mechanism
Compatibility and Requirements
Supported Hardware
| Chassis Model | Minimum FXOS Version | Required Supervisor Module |
|---|---|---|
| FPR4115 | 5.0(1.10) | Supervisor 2.5 |
| FPR4145 | 5.0(2.1) | Supervisor 3.0 |
| FPR9300 | 5.0(3.1) | Supervisor 3.2 |
Software Dependencies
- Requires FXOS 5.0.3 base installation
- Incompatible with Firepower 2100 series appliances
- Mandates OpenSSL 3.1.4+ for cryptographic operations
Accessing the Software Package
The fxos-k9-kickstart.5.0.3.N2.4.141.267.SPA bundle is available through Cisco’s Secure Download Portal to Smart License holders. At IOSHub.net, we provide authenticated mirror access for partners with active TAC contracts. Submit your Cisco Service Connection ID via our verification system to obtain temporary download credentials.
References
: Cisco Security Advisory CSCwc62413 (May 2025)
: Firepower 9300 Hardware Installation Guide Rev.5.2
: FXOS Auto-Installation Procedure Documentation
