Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-20359

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adap

Affects Cisco ASA Software and Firepower Threat Defense Software running a vulnerable release. CVSS scores it 6.0 (Medium); no vendor severity rating is given.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
None on Exploit-DB, Metasploit or GitHub

Summary

This vulnerability affects Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An authenticated local attacker with administrator privileges could execute arbitrary code with root-level privileges that persists across device reboots, potentially altering system behavior.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

Timeline

  1. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  2. CVE published
  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Cisco Cisco Adaptive Security Appliance (ASA) Software

    9.8.1, 9.8.1.5, 9.8.1.7, 9.8.2, 9.8.2.8, 9.8.2.14, 9.8.2.15, 9.8.2.17, 9.8.2.20, 9.8.2.24, 9.8.2.26, 9.8.2.28, 9.8.2.33, 9.8.2.35, 9.8.2.38, 9.8.3.8, 9.8.3.11, 9.8.3.14, 9.8.3.16, 9.8.3.18, 9.8.3.21, 9.8.3, 9.8.3.26, 9.8.3.29, 9.8.4, 9.8.4.3, 9.8.4.7, 9.8.4.8, 9.8.4.10, 9.8.4.12, and 157 more

  • Cisco Cisco Firepower Threat Defense Software

    6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5, 6.2.3.6, 6.2.3.7, 6.2.3.8, 6.2.3.10, 6.2.3.11, 6.2.3.9, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.15, 6.2.3.16, 6.2.3.17, 6.2.3.18, 6.6.0, 6.6.0.1, 6.6.1, 6.6.3, 6.6.4, 6.6.5, 6.6.5.1, 6.6.5.2, 6.6.7, 6.6.7.1, 6.4.0, and 50 more

References 1

sec.cloudapps.cisco.com

FAQ

Questions about CVE-2024-20359

Am I affected, and how do I check?

Affected products are Cisco ASA Software and Cisco Firepower Threat Defense Software running a vulnerable release. Check the running software version on the device with the show version command and compare it with the vulnerable release list in the Cisco advisory.Source: sec.cloudapps.cisco.com

What should I do about it?

The checked facts do not name a fixed release. Check the Cisco advisory for the first fixed version of ASA or FTD Software and upgrade to it.Source: sec.cloudapps.cisco.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-04-24, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data

What if there's no patch?

The checked facts do not describe a workaround. Consult the Cisco advisory for mitigation guidance while no fixed release is available.Source: sec.cloudapps.cisco.com