.webp)
Summary
A vulnerability in Cisco Adaptive Security Appliance (ASA) software and Cisco Firepower Threat Defense (FTD) software, categorized as CVE-2024-20353 (CVSSv3: 8.6), results in a denial-of-service condition when exploited, allowing an unauthenticated, remote attacker to cause the device to reload unexpectedly. According to Cisco, this vulnerability is due to incomplete error checking when parsing an HTTP header. It is exploited by sending a specifically crafted HTTP request to a targeted web server. CISA has added this to their Known Exploited Vulnerabilities Catalog, adding to the urgency to remediate.
Impact Assessment
This vulnerability allows a remote, unauthenticated attacker to perform an exploit to cause a denial-of-service condition on the affected device. Evidence of exploitation has been confirmed by Cisco.
According to Cisco, to determine whether a device that is running Cisco ASA or FTD is affected, use the “show asp table socket | include SSL” command and look for an SSL listen socket on any port.
Remediation
Please see the Cisco Software Checker to determine the version to which you are required to update.
The following resources from Cisco will assist in determining your best choice:
- Cisco Firepower Management Center Upgrade Guide
- Cisco Secure Firewall ASA Compatibility
- Cisco Secure Firewall ASA Upgrade Guide
- Cisco Secure Firewall Threat Defense Compatibility Guide
What It Means for You
If you are a user of Cisco ASA or Cisco FTD software, you are advised to review their security advisory, utilize the Cisco Software Checker to see if you are vulnerable, and perform updates if applicable.
Business Implications
Exploitation of this vulnerability allows for a denial-of-service condition to be applied to VPN servers for the ASA and FTD software it could be crippling to the business. VPN connections are crucial for providing a secure connection to internal organizational resources, if a user is unable to connect to this VPN service, they will not be able to perform business operations.
Access Point Consulting Recommends
Patch: We recommend patching the following software as soon as possible, exploitation would be detrimental to the organization’s bottom line, and there is evidence of active exploitation, raising the risk level.
Associated Bulletins
https://nvd.nist.gov/vuln/detail/CVE-2024-20353
.jpg)
