CVE-2024-20392
Cisco Asyncos 11.0.3-238 … 15.5.0-048
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20392 is a medium-severity HTTP Request/Response Splitting (CWE-113) vulnerability in Cisco Asyncos. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Protocol or Service Impersonation (T1001.003); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-15 (Information Output Filtering) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18107
Vulnerability Data
A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters…
more
that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.2V4.1.3V1.3.6V4.2.3
Mitigating Controls (NIST 800-53 r5) AI
Input validation stops unneutralized CR/LF characters from being accepted and later emitted in HTTP headers.
Output filtering can neutralize CRLF sequences before they reach HTTP response headers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input sanitization and header handling that prevent CRLF injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reach HTTP header sanitization and therefore stop most (but not all) instances of CRLF injection from reaching production; a bounded remainder exists in implementation gaps, outsourced development without full assurance, and post-deployment changes.
A.8.26 explicitly lists resilience against SQL injections and input validation as application security requirements (items d and j), which directly addresses improper neutralization of special sequences like CRLF in HTTP headers; however, this is only one slice of a broad requirements-identification control whose coverage of other injection vectors, output handling, and non-web contexts leaves a bounded remainder.
A.8.27 mandates security-by-design principles (including input distrust, data validation/sanitization, secure architecture layers, and design reviews against attack patterns) that reach HTTP header sanitization and would stop most CRLF splitting if applied; this is a minority slice of the weakness because the clause is a general process that depends on specific implementation rigor and does not itself neutralize sequences in every code path or library.
Secure coding standards require neutralization of CRLF sequences before inclusion in HTTP headers.