Cisco ASA/FTD VPN Web Server LCE via Backup File Exploit
CVE-2024-20485 Published on October 23, 2024

A vulnerability in the VPN web server of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a specific file when it is read from system flash memory. An attacker could exploit this vulnerability by restoring a crafted backup file to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

NVD

Vulnerability Analysis

CVE-2024-20485 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2024-20485 has been classified to as a Code Injection vulnerability or weakness.


Products Associated with CVE-2024-20485

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-20485 are published in these products:

Cisco Adaptive Security Appliance Software
 
Cisco Firepower Threat Defense Software
 

Affected Versions

Cisco Adaptive Security Appliance (ASA) Software: Cisco Firepower Threat Defense Software: cisco adaptive_security_appliance_software: cisco firepower_threat_defense_software:

Exploit Probability

EPSS
0.04%
Percentile
10.15%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.