Authentication Bypass by Spoofing in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) - CVE-2024-20384

Vulnerability identifier: #VU99340

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20384

CWE-ID: CWE-290

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a logic error in populating group ACLs within the Network Service Group (NSG) feature. A remote attacker can bypass configured ACL rules.

Cisco Secure Firewall Adaptive Security Appliance (ASA)
Cisco Secure Firewall Threat Defense (FTD)

Install updates from vendor's website.

Cisco Secure Firewall Adaptive Security Appliance (ASA) - addressed in versions 7.0.6.3, 7.2.9, 7.4.2.1, 7.6.0, 9.16.4.62, 9.16.4.67, 9.16.4.70, 9.16.4.71, 9.17.1.45, 9.18.4.34, 9.18.4.40, 9.18.4.47, 9.19.1.37, 9.20.3, 9.20.3.4, 9.20.3.7, 9.22.1.1
Cisco Secure Firewall Threat Defense (FTD) - addressed in versions 7.0.6.3, 7.2.9, 7.4.2.1, 7.6.0, 9.16.4.62, 9.16.4.67, 9.16.4.70, 9.16.4.71, 9.17.1.45, 9.18.4.34, 9.18.4.40, 9.18.4.47, 9.19.1.37, 9.20.3, 9.20.3.4, 9.20.3.7, 9.22.1.1

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-nsgacl-bypass-77XnEAsL

• Authentication Bypass by Spoofing in Cisco Adaptive Security Appliance and Firepower Threat Defense Software