CVE-2024-20359
Cisco Adaptive Security Appliance Software 9.12.1 … 9.8.4.8
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20359 is a medium-severity Code Injection (CWE-94) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in a legacy capability for preloading VPN clients and plug-ins affects Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The issue stems from improper validation of files read from system flash memory and could permit an authenticated local attacker to execute arbitrary code with root-level privileges after a device reload. Administrator privileges are required, and the injected code can persist across reboots, prompting Cisco to raise the Security Impact Rating from Medium to High. The flaw carries a CVSS 3.1 score of 6.0 and is associated with CWE-94.
An attacker with local administrative access can exploit the vulnerability by placing a crafted file on the disk0: file system of an affected device. Successful exploitation allows arbitrary code execution on the next reload, enabling alteration of system behavior that survives reboots.
Cisco has published a security advisory detailing the issue, and the vulnerability appears in CISA's Known Exploited Vulnerabilities catalog. The associated EPSS score rose materially from a low baseline to a peak of 0.0118 on 2024-04-25 before receding, indicating post-disclosure exploitation interest.
A Talos Intelligence report links the vulnerability to the ArcaneDoor espionage campaign targeting perimeter network devices.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18074
Vulnerability Data
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local…
more
attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
- CWE(s)
- KEV Date Added
- 24 April 2024
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Input validation directly stops untrusted data from being used to construct executable code without neutralization.
Least privilege limits the damage an injected code fragment can perform once executed.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.