Skip to content
Fencer Vulns
medium 6.0

CVE-2024-20359 kev in the critical feed json

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Ada…

published 2024-04-24 2 y ago modified 2026-08-11 2 mo ago also EUVD-2024-18074

cvss
6.0
version 3.1, CNA
cisa kev
Exploited
added 2024-04-24
epss
18.8%
EPSS 18.8% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  • cisco asa 9.14.4.23

Timeline

  1. Added to CISA KEV
  2. Published
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
2 y ago
Patch by
2024-05-01 (2 y ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product
Cisco, Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
CISA name
Cisco ASA and FTD Privilege Escalation Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1078 Valid Accounts exploitation
  • T1059 Command and Scripting Interpreter primary impact
  • T1037 Boot or Logon Initialization Scripts secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

18.82% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • blog.talosintelligence.com https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Cisco Cisco Adaptive Security Appliance (ASA) Software
  • Cisco Cisco Firepower Threat Defense Software
  • cisco asa
  • cisco firepower_threat_defense_software

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.