Improper Handling of Extra Values in Cisco Secure Firewall Threat Defense (FTD) and Cisco Secure Firewall Adaptive Security Appliance (ASA) - CVE-2024-20268

Vulnerability identifier: #VU99321

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20268

CWE-ID: CWE-231

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in the Simple Network Management Protocol (SNMP) feature. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Cisco Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Adaptive Security Appliance (ASA)

Install updates from vendor's website.

Cisco Secure Firewall Threat Defense (FTD) - addressed in versions 7.0.6.2, 7.0.6.3, 7.2.6, 7.2.7, 7.2.8, 7.2.8.1, 7.2.9, 7.4.2, 7.4.2.1, 7.6.0, 9.16.4.55, 9.16.4.57, 9.16.4.61, 9.16.4.62, 9.16.4.67, 9.16.4.70, 9.16.4.71, 9.17.1.39, 9.17.1.45, 9.18.4.22, 9.18.4.24, 9.18.4.29, 9.18.4.34, 9.18.4.40, 9.18.4.47, 9.19.1.28, 9.19.1.31, 9.19.1.37, 9.20.2.10, 9.20.2.21, 9.20.2.22, 9.20.3, 9.20.3.4, 9.20.3.7, 9.22.1.1
Cisco Secure Firewall Adaptive Security Appliance (ASA) - addressed in versions 7.0.6.2, 7.0.6.3, 7.2.6, 7.2.7, 7.2.8, 7.2.8.1, 7.2.9, 7.4.2, 7.4.2.1, 7.6.0, 9.16.4.55, 9.16.4.57, 9.16.4.61, 9.16.4.62, 9.16.4.67, 9.16.4.70, 9.16.4.71, 9.17.1.39, 9.17.1.45, 9.18.4.22, 9.18.4.24, 9.18.4.29, 9.18.4.34, 9.18.4.40, 9.18.4.47, 9.19.1.28, 9.19.1.31, 9.19.1.37, 9.20.2.10, 9.20.2.21, 9.20.2.22, 9.20.3, 9.20.3.4, 9.20.3.7, 9.22.1.1

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-snmp-dos-7TcnzxTU
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO
• https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300

• Denial of service in Cisco Adaptive Security Appliance and Firepower Threat Defense Software