Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
CVE-2024-20353
Cisco ASA and FTD Denial of Service Vulnerability
Cos'è
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
CISA: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.
Cosa fare
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Scadenza per le agenzie federali USA: 1 maggio 2024
Altre falle sfruttate di Cisco
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 24 ott 2024 | ASA and FTD Denial-of-Service | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Media 5,8 | 16% |
| 24 apr 2024 | ASA and FTD Privilege Escalation | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Media 6,0 | 19% |
| 15 feb 2024 | ASA and FTD Information Disclosure | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Alta 7,5 | 72% |
| 3 nov 2021 | ASA and FTD Read-Only Path Traversal | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Alta 7,5 | >99,9% |
| 3 nov 2021 | ASA and FTD Cross-Site Scripting (XSS) | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Media 6,1 | 86% |
| 14 ott 2026 | Relative Path Traversal | Secure Email Gateway | Critica 9,8 | 2,2% |
| 30 set 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critica 9,8 | 39% |
| 16 set 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critica 10,0 | 76% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.