cyber.hendryadrian.com

CVE

CVE-2024-20359

First Reported
Apr 24, 2024
Latest Reported
Apr 24, 2024
Articles
1
View articles →
IOC
60
View indicators →

CVE Enrichment

CVSS
6.0 MEDIUM
EPSS
19.43%
EPSS Percentile
97.31%
CISA KEV
YES — Known Exploited Vulnerability

Description

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

Technical Details

CVSS Version
3.1
CNA / NVD Source
psirt@cisco.com
Published
25-Apr-2024 02:15
Last Modified
12-Aug-2026 02:33
EPSS Date
2026-10-12
CWE
CWE-94

CVSS Vector

CVSS:3.1 AV:L / AC:L / PR:H / UI:N / S:U / C:H / I:H / A:N

CISA KEV Details

Date Added
2024-04-24
Remediation Due
2024-05-01
Known Ransomware Campaign Use
Unknown
Required Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h; https://nvd.nist.gov/vuln/detail/CVE-2024-20359

Affected Products / Versions

References

Last enrichment sync: 13-Oct-2026 05:54
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE (5)

CVE-2018-01011 related articleCVE-2024-203531 related articleCVE-2025-203331 related articleCVE-2025-203621 related articleCVE-2025-203631 related article

Malware (2)

Line Dancer1 related articleLine Runner1 related article

Threat Actors (2)

STORM-18491 related articleUAT43561 related article

MITRE ATT&CK (14)

T08741 related articleT10371 related articleT10401 related articleT10411 related articleT10551 related articleT10591 related articleT1070.0041 related articleT1071.0011 related articleT1102.0031 related articleT11401 related article

VIEW MORE

Vendors (2)

Cisco1 related articleMicrosoft1 related article

Products (9)

Adaptive Security Appliance1 related articleCisco Adaptive Security Appliances1 related articleCisco Secure Firewall1 related articleMeraki MX1 related articleMicrosoft Exchange1 related articleOpenConnect VPN Server1 related articleSnort1 related articleThreat Defense Virtual1 related articleUmbrella1 related article

Tools (1)

Snort1 related article

Industries (2)

Energy1 related articleTelecommunications1 related article

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.