CVE-2024-20359

EUVD-2024-18074

24.04.2024, 19:15

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability.

 This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

Code Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6 MEDIUM	LOCAL	LOW	HIGH	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 36%

Affected Products (NVD)

Vendor	Product	Version
cisco	adaptive_security_appliance_software	9.8.1
cisco	adaptive_security_appliance_software	9.8.1.5
cisco	adaptive_security_appliance_software	9.8.1.7
cisco	adaptive_security_appliance_software	9.8.2
cisco	adaptive_security_appliance_software	9.8.2.8
cisco	adaptive_security_appliance_software	9.8.2.14
cisco	adaptive_security_appliance_software	9.8.2.15
cisco	adaptive_security_appliance_software	9.8.2.17
cisco	adaptive_security_appliance_software	9.8.2.20
cisco	adaptive_security_appliance_software	9.8.2.24
cisco	adaptive_security_appliance_software	9.8.2.26
cisco	adaptive_security_appliance_software	9.8.2.28
cisco	adaptive_security_appliance_software	9.8.2.33
cisco	adaptive_security_appliance_software	9.8.2.35
cisco	adaptive_security_appliance_software	9.8.2.38
cisco	adaptive_security_appliance_software	9.8.3
cisco	adaptive_security_appliance_software	9.8.3.8
cisco	adaptive_security_appliance_software	9.8.3.11
cisco	adaptive_security_appliance_software	9.8.3.14
cisco	adaptive_security_appliance_software	9.8.3.16
cisco	adaptive_security_appliance_software	9.8.3.18
cisco	adaptive_security_appliance_software	9.8.3.21
cisco	adaptive_security_appliance_software	9.8.3.26
cisco	adaptive_security_appliance_software	9.8.3.29
cisco	adaptive_security_appliance_software	9.8.4
cisco	adaptive_security_appliance_software	9.8.4.3
cisco	adaptive_security_appliance_software	9.8.4.7
cisco	adaptive_security_appliance_software	9.8.4.8
cisco	adaptive_security_appliance_software	9.8.4.10
cisco	adaptive_security_appliance_software	9.8.4.12
cisco	adaptive_security_appliance_software	9.8.4.15
cisco	adaptive_security_appliance_software	9.8.4.17
cisco	adaptive_security_appliance_software	9.8.4.20
cisco	adaptive_security_appliance_software	9.8.4.22
cisco	adaptive_security_appliance_software	9.8.4.25
cisco	adaptive_security_appliance_software	9.8.4.26
cisco	adaptive_security_appliance_software	9.8.4.29
cisco	adaptive_security_appliance_software	9.8.4.32
cisco	adaptive_security_appliance_software	9.8.4.33
cisco	adaptive_security_appliance_software	9.8.4.34
cisco	adaptive_security_appliance_software	9.8.4.35
cisco	adaptive_security_appliance_software	9.8.4.39
cisco	adaptive_security_appliance_software	9.8.4.40
cisco	adaptive_security_appliance_software	9.8.4.41
cisco	adaptive_security_appliance_software	9.8.4.43
cisco	adaptive_security_appliance_software	9.8.4.44
cisco	adaptive_security_appliance_software	9.8.4.45
cisco	adaptive_security_appliance_software	9.8.4.46
cisco	adaptive_security_appliance_software	9.8.4.48
cisco	adaptive_security_appliance_software	9.12.1
cisco	adaptive_security_appliance_software	9.12.1.2
cisco	adaptive_security_appliance_software	9.12.1.3
cisco	adaptive_security_appliance_software	9.12.2
cisco	adaptive_security_appliance_software	9.12.2.1
cisco	adaptive_security_appliance_software	9.12.2.4
cisco	adaptive_security_appliance_software	9.12.2.5
cisco	adaptive_security_appliance_software	9.12.2.9
cisco	adaptive_security_appliance_software	9.12.3
cisco	adaptive_security_appliance_software	9.12.3.2
cisco	adaptive_security_appliance_software	9.12.3.7
cisco	adaptive_security_appliance_software	9.12.3.9
cisco	adaptive_security_appliance_software	9.12.3.12
cisco	adaptive_security_appliance_software	9.12.4
cisco	adaptive_security_appliance_software	9.12.4.2
cisco	adaptive_security_appliance_software	9.12.4.4
cisco	adaptive_security_appliance_software	9.12.4.7
cisco	adaptive_security_appliance_software	9.12.4.8
cisco	adaptive_security_appliance_software	9.12.4.10
cisco	adaptive_security_appliance_software	9.12.4.13
cisco	adaptive_security_appliance_software	9.12.4.18
cisco	adaptive_security_appliance_software	9.12.4.24
cisco	adaptive_security_appliance_software	9.12.4.26
cisco	adaptive_security_appliance_software	9.12.4.29
cisco	adaptive_security_appliance_software	9.12.4.30
cisco	adaptive_security_appliance_software	9.12.4.35
cisco	adaptive_security_appliance_software	9.12.4.37
cisco	adaptive_security_appliance_software	9.12.4.38
cisco	adaptive_security_appliance_software	9.12.4.39
cisco	adaptive_security_appliance_software	9.12.4.40
cisco	adaptive_security_appliance_software	9.12.4.41
cisco	adaptive_security_appliance_software	9.12.4.47
cisco	adaptive_security_appliance_software	9.12.4.48
cisco	adaptive_security_appliance_software	9.12.4.50
cisco	adaptive_security_appliance_software	9.12.4.52
cisco	adaptive_security_appliance_software	9.12.4.54
cisco	adaptive_security_appliance_software	9.12.4.55
cisco	adaptive_security_appliance_software	9.12.4.56
cisco	adaptive_security_appliance_software	9.12.4.58
cisco	adaptive_security_appliance_software	9.12.4.62
cisco	adaptive_security_appliance_software	9.12.4.65
cisco	adaptive_security_appliance_software	9.14.1
cisco	adaptive_security_appliance_software	9.14.1.6
cisco	adaptive_security_appliance_software	9.14.1.10
cisco	adaptive_security_appliance_software	9.14.1.15
cisco	adaptive_security_appliance_software	9.14.1.19
cisco	adaptive_security_appliance_software	9.14.1.30
cisco	adaptive_security_appliance_software	9.14.2
cisco	adaptive_security_appliance_software	9.14.2.4
cisco	adaptive_security_appliance_software	9.14.2.8
cisco	adaptive_security_appliance_software	9.14.2.13
cisco	adaptive_security_appliance_software	9.14.2.15
cisco	adaptive_security_appliance_software	9.14.3
cisco	adaptive_security_appliance_software	9.14.3.1
cisco	adaptive_security_appliance_software	9.14.3.9
cisco	adaptive_security_appliance_software	9.14.3.11
cisco	adaptive_security_appliance_software	9.14.3.13
cisco	adaptive_security_appliance_software	9.14.3.15
cisco	adaptive_security_appliance_software	9.14.3.18
cisco	adaptive_security_appliance_software	9.14.4
cisco	adaptive_security_appliance_software	9.14.4.6
cisco	adaptive_security_appliance_software	9.14.4.7
cisco	adaptive_security_appliance_software	9.14.4.12
cisco	adaptive_security_appliance_software	9.14.4.13
cisco	adaptive_security_appliance_software	9.14.4.14
cisco	adaptive_security_appliance_software	9.14.4.15
cisco	adaptive_security_appliance_software	9.14.4.17
cisco	adaptive_security_appliance_software	9.14.4.22
cisco	adaptive_security_appliance_software	9.14.4.23
cisco	adaptive_security_appliance_software	9.15.1
cisco	adaptive_security_appliance_software	9.15.1.1
cisco	adaptive_security_appliance_software	9.15.1.7
cisco	adaptive_security_appliance_software	9.15.1.10
cisco	adaptive_security_appliance_software	9.15.1.15
cisco	adaptive_security_appliance_software	9.15.1.16
cisco	adaptive_security_appliance_software	9.15.1.17
cisco	adaptive_security_appliance_software	9.15.1.21
cisco	adaptive_security_appliance_software	9.16.1
cisco	adaptive_security_appliance_software	9.16.1.28
cisco	adaptive_security_appliance_software	9.16.2
cisco	adaptive_security_appliance_software	9.16.2.3
cisco	adaptive_security_appliance_software	9.16.2.7
cisco	adaptive_security_appliance_software	9.16.2.11
cisco	adaptive_security_appliance_software	9.16.2.13
cisco	adaptive_security_appliance_software	9.16.2.14
cisco	adaptive_security_appliance_software	9.16.3
cisco	adaptive_security_appliance_software	9.16.3.3
cisco	adaptive_security_appliance_software	9.16.3.14
cisco	adaptive_security_appliance_software	9.16.3.15
cisco	adaptive_security_appliance_software	9.16.3.19
cisco	adaptive_security_appliance_software	9.16.3.23
cisco	adaptive_security_appliance_software	9.16.4
cisco	adaptive_security_appliance_software	9.16.4.9
cisco	adaptive_security_appliance_software	9.16.4.14
cisco	adaptive_security_appliance_software	9.16.4.18
cisco	adaptive_security_appliance_software	9.16.4.19
cisco	adaptive_security_appliance_software	9.16.4.27
cisco	adaptive_security_appliance_software	9.16.4.38
cisco	adaptive_security_appliance_software	9.16.4.39
cisco	adaptive_security_appliance_software	9.16.4.42
cisco	adaptive_security_appliance_software	9.16.4.48
cisco	adaptive_security_appliance_software	9.16.4.55
cisco	adaptive_security_appliance_software	9.17.1
cisco	adaptive_security_appliance_software	9.17.1.7
cisco	adaptive_security_appliance_software	9.17.1.9
cisco	adaptive_security_appliance_software	9.17.1.10
cisco	adaptive_security_appliance_software	9.17.1.11
cisco	adaptive_security_appliance_software	9.17.1.13
cisco	adaptive_security_appliance_software	9.17.1.15
cisco	adaptive_security_appliance_software	9.17.1.20
cisco	adaptive_security_appliance_software	9.17.1.30
cisco	adaptive_security_appliance_software	9.17.1.33
cisco	adaptive_security_appliance_software	9.18.1
cisco	adaptive_security_appliance_software	9.18.1.3
cisco	adaptive_security_appliance_software	9.18.2
cisco	adaptive_security_appliance_software	9.18.2.5
cisco	adaptive_security_appliance_software	9.18.2.7
cisco	adaptive_security_appliance_software	9.18.2.8
cisco	adaptive_security_appliance_software	9.18.3
cisco	adaptive_security_appliance_software	9.18.3.39
cisco	adaptive_security_appliance_software	9.18.3.46
cisco	adaptive_security_appliance_software	9.18.3.53
cisco	adaptive_security_appliance_software	9.18.3.55
cisco	adaptive_security_appliance_software	9.18.3.56
cisco	adaptive_security_appliance_software	9.18.4
cisco	adaptive_security_appliance_software	9.18.4.5
cisco	adaptive_security_appliance_software	9.18.4.8
cisco	adaptive_security_appliance_software	9.19.1
cisco	adaptive_security_appliance_software	9.19.1.5
cisco	adaptive_security_appliance_software	9.19.1.9
cisco	adaptive_security_appliance_software	9.19.1.12
cisco	adaptive_security_appliance_software	9.19.1.18
cisco	adaptive_security_appliance_software	9.19.1.22
cisco	adaptive_security_appliance_software	9.19.1.24
cisco	adaptive_security_appliance_software	9.19.1.27
cisco	adaptive_security_appliance_software	9.20.1
cisco	adaptive_security_appliance_software	9.20.1.5
cisco	adaptive_security_appliance_software	9.20.2
cisco	firepower_threat_defense	6.2.3
cisco	firepower_threat_defense	6.2.3.1
cisco	firepower_threat_defense	6.2.3.2
cisco	firepower_threat_defense	6.2.3.3
cisco	firepower_threat_defense	6.2.3.4
cisco	firepower_threat_defense	6.2.3.5
cisco	firepower_threat_defense	6.2.3.6
cisco	firepower_threat_defense	6.2.3.7
cisco	firepower_threat_defense	6.2.3.8
cisco	firepower_threat_defense	6.2.3.9
cisco	firepower_threat_defense	6.2.3.10
cisco	firepower_threat_defense	6.2.3.11
cisco	firepower_threat_defense	6.2.3.12
cisco	firepower_threat_defense	6.2.3.13
cisco	firepower_threat_defense	6.2.3.14
cisco	firepower_threat_defense	6.2.3.15
cisco	firepower_threat_defense	6.2.3.16
cisco	firepower_threat_defense	6.2.3.17
cisco	firepower_threat_defense	6.2.3.18
cisco	firepower_threat_defense	6.4.0
cisco	firepower_threat_defense	6.4.0.1
cisco	firepower_threat_defense	6.4.0.2
cisco	firepower_threat_defense	6.4.0.3
cisco	firepower_threat_defense	6.4.0.4
cisco	firepower_threat_defense	6.4.0.5
cisco	firepower_threat_defense	6.4.0.6
cisco	firepower_threat_defense	6.4.0.7
cisco	firepower_threat_defense	6.4.0.8
cisco	firepower_threat_defense	6.4.0.9
cisco	firepower_threat_defense	6.4.0.10
cisco	firepower_threat_defense	6.4.0.11
cisco	firepower_threat_defense	6.4.0.12
cisco	firepower_threat_defense	6.4.0.13
cisco	firepower_threat_defense	6.4.0.14
cisco	firepower_threat_defense	6.4.0.15
cisco	firepower_threat_defense	6.4.0.16
cisco	firepower_threat_defense	6.4.0.17
cisco	firepower_threat_defense	6.6.0
cisco	firepower_threat_defense	6.6.0.1
cisco	firepower_threat_defense	6.6.1
cisco	firepower_threat_defense	6.6.3
cisco	firepower_threat_defense	6.6.4
cisco	firepower_threat_defense	6.6.5
cisco	firepower_threat_defense	6.6.5.1
cisco	firepower_threat_defense	6.6.5.2
cisco	firepower_threat_defense	6.6.7
cisco	firepower_threat_defense	6.6.7.1
cisco	firepower_threat_defense	6.7.0
cisco	firepower_threat_defense	6.7.0.1
cisco	firepower_threat_defense	6.7.0.2
cisco	firepower_threat_defense	6.7.0.3
cisco	firepower_threat_defense	7.0.0
cisco	firepower_threat_defense	7.0.0.1
cisco	firepower_threat_defense	7.0.1
cisco	firepower_threat_defense	7.0.1.1
cisco	firepower_threat_defense	7.0.2
cisco	firepower_threat_defense	7.0.2.1
cisco	firepower_threat_defense	7.0.3
cisco	firepower_threat_defense	7.0.4
cisco	firepower_threat_defense	7.0.5
cisco	firepower_threat_defense	7.0.6
cisco	firepower_threat_defense	7.0.6.1
cisco	firepower_threat_defense	7.1.0
cisco	firepower_threat_defense	7.1.0.1
cisco	firepower_threat_defense	7.1.0.2
cisco	firepower_threat_defense	7.1.0.3
cisco	firepower_threat_defense	7.2.0
cisco	firepower_threat_defense	7.2.0.1
cisco	firepower_threat_defense	7.2.1
cisco	firepower_threat_defense	7.2.2
cisco	firepower_threat_defense	7.2.3
cisco	firepower_threat_defense	7.2.4
cisco	firepower_threat_defense	7.2.4.1
cisco	firepower_threat_defense	7.2.5
cisco	firepower_threat_defense	7.2.5.1
cisco	firepower_threat_defense	7.3.0
cisco	firepower_threat_defense	7.3.1
cisco	firepower_threat_defense	7.3.1.1
cisco	firepower_threat_defense	7.4.0
cisco	firepower_threat_defense	7.4.1

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
cisco	asa	9.12.1 ≤ 𝑥 ≤ 9.12.4.65	ADP
cisco	asa	9.14.1 ≤ 𝑥 < 9.14.4.23	ADP
cisco	asa	9.15.1 ≤ 𝑥 ≤ 9.15.1.21	ADP
cisco	asa	9.16.1 ≤ 𝑥 ≤ 9.16.4.55	ADP
cisco	asa	9.17.1 ≤ 𝑥 ≤ 9.17.1.33	ADP
cisco	asa	9.18.1 ≤ 𝑥 ≤ 9.18.4.8	ADP
cisco	asa	9.19.1 ≤ 𝑥 ≤ 9.19.1.27	ADP
cisco	asa	9.20.1 ≤ 𝑥 ≤ 9.20.2	ADP
cisco	firepower_threat_defense_software	6.2.3 ≤ 𝑥 ≤ 6.2.3.18	ADP
cisco	firepower_threat_defense_software	6.6.0 ≤ 𝑥 ≤ 6.6.7.1	ADP
cisco	firepower_threat_defense_software	6.4.0 ≤ 𝑥 ≤ 6.4.0.17	ADP
cisco	firepower_threat_defense_software	6.7.0 ≤ 𝑥 ≤ 6.7.0.3	ADP
cisco	firepower_threat_defense_software	7.0.0 ≤ 𝑥 ≤ 7.0.6	ADP
cisco	firepower_threat_defense_software	7.1.0 ≤ 𝑥 ≤ 7.1.0.3	ADP
cisco	firepower_threat_defense_software	7.2.0 ≤ 𝑥 ≤ 7.2.4.1	ADP
cisco	firepower_threat_defense_software	7.3.0 ≤ 𝑥 ≤ 7.3.1.1	ADP
cisco	firepower_threat_defense_software	7.4.0 ≤ 𝑥 ≤ 7.4.1	ADP
cisco	asa	9.8.1 ≤ 𝑥 ≤ 9.8.4.48	ADP

Known Exploits!

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Common Weakness Enumeration

CWE-94 - Improper Control of Generation of Code ('Code Injection')
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20359