Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20353 is a high-severity Infinite Loop (CWE-835) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 0.6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-20353 affects the management and VPN web servers in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The flaw stems from incomplete error checking during HTTP header parsing and carries a CVSS 3.1 score of 8.6. Successful exploitation triggers an unexpected device reload and resulting denial-of-service condition.
An unauthenticated remote attacker can trigger the vulnerability by sending a single crafted HTTP request to either web server interface. No authentication or user interaction is required, and the attack can be launched over the network with low complexity, allowing an adversary to interrupt device operation and availability.
The Cisco Security Advisory and CISA Known Exploited Vulnerabilities catalog both list the issue, confirming that affected customers should apply the fixes published in the vendor advisory. The vulnerability has also been linked to the ArcaneDoor espionage campaign that targeted perimeter network devices.
EPSS scores rose from a low baseline to a recorded peak of 0.2445 (current value 0.1883), indicating emerging exploitation interest after public disclosure and warranting renewed attention from defenders.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18068
Vulnerability Data
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial…
more
of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
- CWE(s)
- KEV Date Added
- 24 April 2024
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover unreachable loop exit conditions through static analysis, fuzzing, or execution tracing.
Flaw remediation processes identify and correct infinite-loop defects reported from testing or operations.
Requiring documented development processes and secure coding standards reduces introduction of loops whose termination conditions are unreachable.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.