CVE-2024-20299
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in the AnyConnect firewall for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured ACL and allow traffic that should have been denied. This is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session. An attacker could exploit this by establishing an AnyConnect connection to the affected device.
Risk Assessment
Bypassing configured ACL rules may allow unauthorized network access, potentially leading to security breaches and data leakage.
Recommendation
Install Cisco updates for ASA and FTD. Review group ACL configurations and monitor AnyConnect connections for suspicious activity.
Other vulnerabilities in Cisco ASA Software
See all- CVE-2016-6432High
A vulnerability in the Identity Firewall feature of Cisco ASA Software before version 9.6(2.1) could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The issue is due to a buffer overflow in the affected code area.
- CVE-2016-6431High
A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before version 9.6(1.5) could allow an unauthenticated, remote attacker to cause a reload of the affected system. The issue is due to improper handling of crafted packets during the enrollment operation.
- CVE-2014-3392High
The Clientless SSL VPN portal in Cisco ASA Software before version 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.8), and 9.3(1.1) allows remote attackers to obtain sensitive information from process memory or modify memory contents via crafted parameters.
- CVE-2014-3389High
The VPN implementation in Cisco ASA Software versions before 7.2(5.15), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.6), and 9.3(1.1) does not properly implement a tunnel filter, allowing remote authenticated users to gain failover-unit access via crafted packets.
- CVE-2014-3388High
The DNS inspection engine in Cisco ASA Software 9.0 before 9.0(4.13), 9.1 before 9.1(5.7), and 9.2 before 9.2(2) allows remote attackers to cause a denial of service (device reload) via crafted DNS packets.
- CVE-2014-3387High
The SunRPC inspection engine in Cisco ASA Software before versions 7.2(5.14), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.5(1.21), 8.6(1.14), 8.7(1.13), 9.0(4.5), and 9.1(5.3) allows remote attackers to cause a denial of service (device reload) via crafted SunRPC packets.
- CVE-2014-3386High
The GPRS Tunneling Protocol (GTP) inspection engine in Cisco ASA Software before version 8.2(5.51), 8.4(7.15), 8.7(1.13), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted series of GTP packets.
- CVE-2014-3385High
A race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA allows remote attackers to cause a denial of service by generating many half-open TCP connections simultaneously.
- CVE-2014-3384High
The IKEv2 implementation in Cisco ASA Software before versions 8.4(7.15), 8.6(1.14), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service by sending a crafted packet during tunnel creation.
- CVE-2014-3383High
The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted UDP packets.
Original NVD description (English source)
A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. An attacker could exploit this vulnerability by establishing an AnyConnect connection to the affected device. A successful exploit could allow the attacker to bypass configured ACL rules.