Missing Release of Resource after Effective Lifetime in Cisco Adaptive Security Appliance (ASA) and Cisco Firewall Threat Defense (FTD) - CVE-2024-20493
Published: October 24, 2024
Vulnerability identifier: #VU99328
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-20493
CWE-ID: CWE-772
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco Adaptive Security Appliance (ASA)
Cisco Firewall Threat Defense (FTD)
Cisco Adaptive Security Appliance (ASA)
Cisco Firewall Threat Defense (FTD)
Detailed vulnerability description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to ineffective handling of memory resources during the authentication process within the login authentication functionality of the Remote Access SSL VPN feature. A remote attacker can cause a denial of service condition on the target system.
How to mitigate CVE-2024-20493
Install updates from vendor's website.