PT-2024-7485 · Cisco · Cisco Asa+1

Published 2024-10-23 · Updated 2025-08-01 · CVE-2024-20384

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description: A logic error in the Network Service Group (NSG) feature could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should be denied to flow through an affected device. This issue occurs when NSG ACLs are populated on an affected device. An attacker could exploit this by establishing a connection to the affected device, potentially bypassing configured ACL rules.

Recommendations: For Cisco Adaptive Security Appliance (ASA) Software, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Firepower Threat Defense (FTD) Software, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2024-08867

CVE-2024-20384

Affected Products

Cisco Asa

Cisco Ftd

References · 5

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-nsgacl-bypass-77XnEAsL · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20384 · Security Note
• https://bdu.fstec.ru/vul/2024-08867 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20384 · Vendor Advisory
• https://t.me/cveNotify/130565 · Telegram Post