Medium severity · published Apr 24, 2024
CVE-2024-20359
Cisco ASA and FTD Privilege Escalation Vulnerability
In wildKEV
6.0
CVSS
18.8%
EPSS
Yes
On KEV
Description
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability.
This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)18.8% · higher than 97% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 24, 2024
Federal remediation dueMay 1, 2024
Ransomware campaign useNot known
Affected products
Which versions
AS
Adaptive Security Appliance · Cisco
9.12.1 through 9.12.4.65; 9.14.1 before 9.14.4.23; 9.15.1 through 9.15.1.21; 9.16.1 through 9.16.4.55; 9.17.1 through 9.17.1.33; 9.18.1 through 9.18.4.8; +3 more · source: CISA
CA
Cisco Adaptive Security Appliance (ASA) Software · Cisco
9.8.1; 9.8.1.5; 9.8.1.7; 9.8.2; 9.8.2.8; 9.8.2.14; +34 more · source: vendor
CF
Cisco Firepower Threat Defense Software · Cisco
6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; +34 more · source: vendor
AS
Adaptive Security Appliance Software · Cisco
9.8.1; 9.8.1.5; 9.8.1.7; 9.8.2; 9.8.2.8; 9.8.2.14; +34 more · source: NVD
SF
Secure Firewall Threat Defense · Cisco
6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; +34 more · source: NVD
FT
Firepower Threat Defense Software · Cisco
6.2.3 through 6.2.3.18; 6.6.0 through 6.6.7.1; 6.4.0 through 6.4.0.17; 6.7.0 through 6.7.0.3; 7.0.0 through 7.0.6; 7.1.0 through 7.1.0.3; +3 more · source: CISA
AS
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · Cisco
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20359
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20359
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
sec.cloudapps.cisco.com
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h
More from Adaptive Security Appliance
8.6
CVE-2024-20353
Cisco ASA and FTD Denial of Service Vulnerability
8.6
CVE-2021-34793
A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an…
8.6
CVE-2020-3572
A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an…
8.6
CVE-2020-3436
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote…
8.6
CVE-2020-3304
A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote…