Actively exploited in the wild
Cisco ASA and FTD Denial of Service Vulnerability
Cisco - Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · Listed in the CISA KEV since 2024-04-24. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-20353
HighCVSS 8.6KEVExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
A vulnerability in the management and VPN web servers of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. The issue is due to incomplete error checking when parsing an HTTP header. A successful exploit could cause a DoS condition when the device reloads.
Risk Assessment
Risk of device downtime (DoS), impacting availability of network and VPN services.
Recommendation
Apply Cisco updates and restrict access to management and VPN servers to trusted sources only.
Other vulnerabilities in Cisco ASA/FTD
See all- CVE-2024-20481MediumActively exploited
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. The issue is due to resource exhaustion. A successful exploit could exhaust resources, resulting in DoS of the RAVPN service, and a device reload may be required to restore service.
- CVE-2024-20359MediumActively exploited
A vulnerability in a legacy capability for preloading VPN clients and plug-ins in Cisco ASA and FTD Software allows an authenticated, local attacker with administrator privileges to execute arbitrary code with root-level privileges. The issue is due to improper validation of a file read from system flash memory. A successful exploit could allow code execution after the next reload, potentially altering system behavior.
- CVE-2022-20759High
A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit this vulnerability by sending crafted HTTPS messages to the web services interface of an affected device. A successful exploit could allow the attacker to gain privilege level 15 access to the web management interface of the device, including via tools like ASDM or CSM. For FTD, the impact is lower because the management interface allows read-only access.
- CVE-2020-3580MediumActively exploited
Multiple vulnerabilities in the web services interface of Cisco ASA and FTD Software allow an unauthenticated, remote attacker to conduct XSS attacks against users of the interface. The issues are due to insufficient validation of user-supplied input. A successful exploit could allow arbitrary script execution in the interface context or access to sensitive browser-based information.
- CVE-2020-3452HighActively exploited
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to perform directory traversal attacks and read sensitive files. The issue is due to lack of proper input validation of URLs in HTTP requests. A successful exploit allows viewing arbitrary files within the web services file system when WebVPN or AnyConnect features are enabled.
- CVE-2020-3259HighActively exploited
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to retrieve memory contents, potentially leading to disclosure of confidential information. The issue is due to a buffer tracking issue when parsing invalid URLs. A successful exploit could allow memory contents retrieval, leading to information disclosure.
- CVE-2020-3187Critical
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files. The issue is due to lack of proper input validation of the HTTP URL. A successful exploit could allow viewing or deleting arbitrary files in the web services file system, but files are restored after device reload.
- CVE-2018-15454High
A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An attacker could exploit this vulnerability by sending SIP requests designed to trigger this issue at a high rate. Software updates addressing this vulnerability are not yet available.
- CVE-2018-0296HighActively exploited
A vulnerability in the web interface of Cisco ASA could allow an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. In certain releases, directory traversal could also allow unauthenticated disclosure of sensitive system information. The issue is due to lack of proper input validation of the HTTP URL.
- CVE-2018-0231High
A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of the affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious TLS message to an interface enabled for SSL services. Messages using SSLv3 or SSLv2 cannot be used to exploit this vulnerability. An exploit could cause a buffer underflow, triggering a crash. This affects ASAv, FTDv, and Firepower 2100 Series.
Original NVD description (English source)
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS