CVE-2024-20353
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2Vendor Advisory
- blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/ExploitThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20353US Government Resource
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 908 days
- CVSS
- 8.6 HIGH
- EPSS (30-day exploit probability)
- 69.8% · top 1% of all CVEs
- Weakness
- CWE-835
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.