This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco Adaptive Security Appliance and Firepower Threat Defense Software fix 3 vulnerabilities

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software fix 3 vulnerabilities [1][2][3]. Fixed versions can be obtained at [4], where on the first page you need to enter the product type and version. On the next page, select all impact assessments and all security advisories. On the last page, select the highest of the displayed fixed versions and update the affected device to it.

Cisco ASA and Firepower - DoS (CVE-2024-20353)
CVSS 8.6 (High)

An unauthenticated remote attacker can, due to incomplete error checking when processing the HTTP header, send a modified HTTP request to the target web server on the device and carry out a DoS attack when it is reloaded [1].

The vulnerability is present in products:

  • Cisco ASA;
  • Cisco FTD;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

IOC: 185.244.210[.]65,5.183.95[.]95,213.156.138[.]77,45.77.54[.]14,45.77.52[.]253,45.63.119[.]131,194.32.78[.]183,185.244.210[.]120,216.238.81[.]149,216.238.85[.]220,216.238.74[.]95,45.128.134[.]189,176.31.18[.]153,216.238.72[.]201,216.238.71[.]49,216.238.66[.]251,216.238.86[.]24,216.238.75[.]155,154.39.142[.]47,139.162.135[.]12

More information:

The vulnerability was publicly disclosed 24. 4. 2024.

Cisco ASA and Firepower - local code execution (CVE-2024-20359)
CVSS 6.0 (Medium)

An authenticated local attacker can, by copying a malicious file to the "disk0:" file system, achieve remote code execution with root privileges [2].

The vulnerability is present in products:

  • Cisco ASA;
  • Cisco FTD;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 24. 4. 2024.

Cisco ASA and Firepower - local command execution (CVE-2024-20358)
CVSS 6.0 (Medium)

An authenticated local attacker can execute a malicious command in the underlying Linux operating system as root by restoring a modified backup file [3].

The vulnerability is present in products:

  • Cisco ASA;
  • Cisco FTD;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 24. 4. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 29. 4. 2024.

CESNET, z.s.p.o. Logo