Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
CVE-2024-20353
Cisco ASA and FTD Denial of Service Vulnerability
O que é
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
CISA: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.
O que fazer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 1 de maio de 2024
Mais falhas exploradas de Cisco
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 24 de out. de 2024 | ASA and FTD Denial-of-Service | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Média 5,8 | 16% |
| 24 de abr. de 2024 | ASA and FTD Privilege Escalation | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Média 6,0 | 19% |
| 15 de fev. de 2024 | ASA and FTD Information Disclosure | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Alto 7,5 | 72% |
| 3 de nov. de 2021 | ASA and FTD Read-Only Path Traversal | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Alto 7,5 | >99,9% |
| 3 de nov. de 2021 | ASA and FTD Cross-Site Scripting (XSS) | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Média 6,1 | 86% |
| 14 de out. de 2026 | Relative Path Traversal | Secure Email Gateway | Crítica 9,8 | 2,2% |
| 30 de set. de 2026 | Hex Encoding | Catalyst SD-WAN Manager | Crítica 9,8 | 39% |
| 16 de set. de 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Crítica 10,0 | 76% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.