PT-2024-3049 · Cisco · Cisco Asa+1

Published 2024-04-24 · Updated 2026-05-03 · CVE-2024-20353

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) (affected versions not specified) Cisco Firepower Threat Defense (FTD) (affected versions not specified)

Description A flaw in the management and VPN web servers of the affected software allows an unauthenticated remote attacker to cause a denial of service (DoS) condition. The issue stems from incomplete error checking when parsing an HTTP header or the execution of a loop with an unreachable exit condition. An attacker can trigger an unexpected device reload by sending a specially crafted HTTP request to a targeted web server on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2024-03233

CVE-2024-20353

Affected Products

Cisco Asa

Cisco Ftd

References · 99

• 🔥 https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices · Exploit
• https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/707137 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20353 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20353 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/707676 · Security Note
• https://bdu.fstec.ru/vul/2024-03233 · Security Note
• https://twitter.com/dansantanna/status/1784960985054507030 · Twitter Post
• https://twitter.com/ShaiiikShoaiiib/status/1843512157964734713 · Twitter Post
• https://t.me/true_secator/5676 · Telegram Post
• https://twitter.com/transilienceai/status/1811403100181168495 · Twitter Post
• https://twitter.com/NickBla41002745/status/1785186008566558952 · Twitter Post
• https://t.me/aptreports/9425 · Telegram Post
• https://twitter.com/TheRecord_Media/status/1783221490634162401 · Twitter Post