CVE-2024-20408
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability in the Dynamic Access Policies (DAP) feature of Cisco ASA and FTD Software could allow an authenticated, remote attacker to cause an unexpected reload of an affected device. To exploit this, an attacker would need valid remote access VPN user credentials. The issue is due to improper validation of data in HTTPS POST requests. An attacker could exploit this by sending a crafted HTTPS POST request.
Risk Assessment
The attack can cause device downtime, impacting VPN service availability and potentially leading to business disruption.
Recommendation
Apply Cisco-provided updates for ASA and FTD software. Monitor HTTPS POST requests for suspicious patterns.
Other vulnerabilities in Cisco ASA Software
See all- CVE-2016-6432High
A vulnerability in the Identity Firewall feature of Cisco ASA Software before version 9.6(2.1) could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The issue is due to a buffer overflow in the affected code area.
- CVE-2016-6431High
A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before version 9.6(1.5) could allow an unauthenticated, remote attacker to cause a reload of the affected system. The issue is due to improper handling of crafted packets during the enrollment operation.
- CVE-2014-3392High
The Clientless SSL VPN portal in Cisco ASA Software before version 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.8), and 9.3(1.1) allows remote attackers to obtain sensitive information from process memory or modify memory contents via crafted parameters.
- CVE-2014-3389High
The VPN implementation in Cisco ASA Software versions before 7.2(5.15), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.6), and 9.3(1.1) does not properly implement a tunnel filter, allowing remote authenticated users to gain failover-unit access via crafted packets.
- CVE-2014-3388High
The DNS inspection engine in Cisco ASA Software 9.0 before 9.0(4.13), 9.1 before 9.1(5.7), and 9.2 before 9.2(2) allows remote attackers to cause a denial of service (device reload) via crafted DNS packets.
- CVE-2014-3387High
The SunRPC inspection engine in Cisco ASA Software before versions 7.2(5.14), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.5(1.21), 8.6(1.14), 8.7(1.13), 9.0(4.5), and 9.1(5.3) allows remote attackers to cause a denial of service (device reload) via crafted SunRPC packets.
- CVE-2014-3386High
The GPRS Tunneling Protocol (GTP) inspection engine in Cisco ASA Software before version 8.2(5.51), 8.4(7.15), 8.7(1.13), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted series of GTP packets.
- CVE-2014-3385High
A race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA allows remote attackers to cause a denial of service by generating many half-open TCP connections simultaneously.
- CVE-2014-3384High
The IKEv2 implementation in Cisco ASA Software before versions 8.4(7.15), 8.6(1.14), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service by sending a crafted packet during tunnel creation.
- CVE-2014-3383High
The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted UDP packets.
Original NVD description (English source)
A vulnerability in the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly. To exploit this vulnerability, an attacker would need valid remote access VPN user credentials on the affected device. This vulnerability is due to improper validation of data in HTTPS POST requests. An attacker could exploit this vulnerability by sending a crafted HTTPS POST request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition.