Input validation error in Cisco Firewall Threat Defense (FTD) and Cisco Adaptive Security Appliance (ASA) - CVE-2024-20408

Vulnerability identifier: #VU99337

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20408

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of data in HTTPS POST requests in the Dynamic Access Policies (DAP) feature. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Cisco Firewall Threat Defense (FTD)
Cisco Adaptive Security Appliance (ASA)

Install updates from vendor's website.

Cisco Firewall Threat Defense (FTD) - addressed in versions 7.0.6.3, 7.2.9, 7.4.2, 7.4.2.1, 7.6.0, 9.16.4.61, 9.16.4.62, 9.16.4.67, 9.16.4.70, 9.16.4.71, 9.17.1.45, 9.18.4.24, 9.18.4.29, 9.18.4.34, 9.18.4.40, 9.18.4.47, 9.19.1.31, 9.19.1.37, 9.20.2.21, 9.20.2.22, 9.20.3, 9.20.3.4, 9.20.3.7, 9.22.1.1
Cisco Adaptive Security Appliance (ASA) - addressed in versions 7.0.6.3, 7.2.9, 7.4.2, 7.4.2.1, 7.6.0, 9.16.4.61, 9.16.4.62, 9.16.4.67, 9.16.4.70, 9.16.4.71, 9.17.1.45, 9.18.4.24, 9.18.4.29, 9.18.4.34, 9.18.4.40, 9.18.4.47, 9.19.1.31, 9.19.1.37, 9.20.2.21, 9.20.2.22, 9.20.3, 9.20.3.4, 9.20.3.7, 9.22.1.1

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dap-dos-bhEkP7n

• Denial of service in Cisco Adaptive Security Appliance and Firepower Threat Defense Software