PT-2024-7457 · Cisco · Cisco Asa+1

X.B · Published 2024-10-23 · Updated 2025-08-01 · CVE-2024-20408

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description: The issue is related to improper validation of data in HTTPS POST requests to the Dynamic Access Policies (DAP) feature. An attacker with valid remote access VPN user credentials could exploit this by sending a crafted HTTPS POST request, potentially causing the device to reload and resulting in a denial of service (DoS) condition.

Recommendations: For Cisco Adaptive Security Appliance (ASA) Software, update to a version that fixes the improper validation of data in HTTPS POST requests. For Cisco Firepower Threat Defense (FTD) Software, update to a version that fixes the improper validation of data in HTTPS POST requests. As a temporary workaround, consider restricting access to the DAP feature until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-1287

Related Identifiers

BDU:2024-08837

CVE-2024-20408

Affected Products

Cisco Asa

Cisco Ftd

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-20408 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dap-dos-bhEkP7n · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20408 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08837 · Security Note
• https://cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/108000-dap-deploy-guide.html · Vendor Advisory
• https://t.me/cveNotify/130566 · Telegram Post