Rootlevel code exec via preloaded VPN client in Cisco ASA/FTD
CVE-2024-20359 Published on April 24, 2024

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

NVD

Known Exploited Vulnerability

This Cisco ASA and FTD Privilege Escalation Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.

The following remediation steps are recommended / required by May 1, 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2024-20359 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2024-20359 has been classified to as a Code Injection vulnerability or weakness.


Products Associated with CVE-2024-20359

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-20359 are published in these products:

Cisco Adaptive Security Appliance Software
 
Cisco Firepower Threat Defense
 
Cisco Asa
 
Cisco Firepower Threat Defense Software
 

Affected Versions

Cisco Adaptive Security Appliance (ASA) Software: Cisco Firepower Threat Defense Software: cisco asa: cisco asa: cisco asa: cisco asa: cisco asa: cisco asa: cisco asa: cisco asa: cisco firepower_threat_defense_software: cisco firepower_threat_defense_software: cisco firepower_threat_defense_software: cisco firepower_threat_defense_software: cisco firepower_threat_defense_software: cisco firepower_threat_defense_software: cisco firepower_threat_defense_software: cisco firepower_threat_defense_software: cisco firepower_threat_defense_software: cisco asa:

Exploit Probability

EPSS
0.18%
Percentile
39.40%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.