Security Resilience

CVE-2024-20342

Cisco Secure Firewall Threat Defense ≤ 7.0.6.2

Published
23 October 2024
Modified
11 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
EPSS Score 0.0049 41th percentile
Risk Priority 46 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-20342 is a medium-severity Comparison Using Wrong Factors (CWE-1025) vulnerability in Cisco Secure Firewall Threat Defense. Its CVSS base score is 5.8 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter.  This vulnerability is due to an incorrect connection…

more

count comparison. An attacker could exploit this vulnerability by sending traffic through an affected device at a rate that exceeds a configured rate filter. A successful exploit could allow the attacker to successfully bypass the rate filter. This could allow unintended traffic to enter the network protected by the affected device.

CWE(s)
CWE-1025

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1012 Query Registry Discovery
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
attack.mitre.org →
T1016 System Network Configuration Discovery Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
attack.mitre.org →
T1021 Remote Services Lateral Movement
Adversaries may use [Valid Accounts](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-20058Same product: Cisco Secure Firewall Threat Defense
CVE-2024-20363Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20066Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20065Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20057Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20052Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20068Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20054Same product: Cisco Secure Firewall Threat Defense
CVE-2023-20083Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20067Same product: Cisco Secure Firewall Threat Defense

Affected Assets

cisco
snort
3.0.0.0 — 3.1.74.0
cisco
secure firewall threat defense
7.1.0, 7.3.0 · ≤ 7.0.6.2 · 7.2.0 — 7.2.6 · 7.4.0 — 7.4.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover incorrect comparison logic after implementation but does not stop the flaw from being written.

SA-15 Development Process, Standards, and Tools partial match

Requiring a documented development process and tools can embed standards that reduce introduction of erroneous comparison factors.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC activities such as code review and logic testing directly prevent incorrect comparison factors in code.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
blocks

Secure development lifecycle includes requirements and reviews that can catch incorrect comparison logic.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including resilience against injection etc.) be identified and specified during development or acquisition; it does not itself enforce, implement or assure any comparison logic, so the wrong-factor comparison weakness can still be present and exploitable.

A.8.27 Secure system architecture and engineering principles partial match
removes
A.8.28 Secure coding partial match
prevents

Secure coding standards directly address proper comparison logic and factor selection.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect incorrect comparison results during development and acceptance.

A.8.8 Management of technical vulnerabilities partial match
removes

References