CVE-2024-20351
📋 TL;DR
A vulnerability in Cisco Firepower Threat Defense (FTD) and FirePOWER Services allows unauthenticated remote attackers to cause denial of service by sending large amounts of TCP/IP traffic. This causes the device to drop legitimate network traffic, requiring a reboot to restore functionality. Organizations using affected Cisco FTD software versions are at risk.
💻 Affected Systems
- Cisco Firepower Threat Defense (FTD) Software
- Cisco FirePOWER Services
📦 What is this software?
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
Firepower Threat Defense Software by Cisco
⚠️ Risk & Real-World Impact
Worst Case
Complete network outage for all traffic passing through the affected FTD device, requiring physical or console access to reboot the device.
Likely Case
Intermittent or sustained packet loss affecting critical services, leading to application timeouts and user complaints until device is rebooted.
If Mitigated
Limited impact if traffic filtering blocks malicious traffic patterns before reaching the FTD device, or if redundant devices are configured.
🎯 Exploit Status
Exploitation is straightforward - any system capable of generating sufficient network traffic can trigger the condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Cisco advisory for specific fixed versions (typically 7.4.1+ and other release trains)
Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sa-ftd-snort-fw-BCJTZPMu
Restart Required: Yes
Instructions:
1. Review Cisco advisory for exact fixed versions. 2. Download appropriate software update from Cisco. 3. Apply update following Cisco FTD upgrade procedures. 4. Reboot device after update installation.
🔧 Temporary Workarounds
Traffic Rate Limiting
allImplement traffic shaping or rate limiting on upstream devices to prevent large traffic bursts from reaching the FTD device.
Network Segmentation
allIsolate FTD devices from untrusted networks and implement strict access controls to limit who can send traffic to them.
🧯 If You Can't Patch
- Implement aggressive traffic monitoring and alerting for unusual traffic patterns targeting FTD devices
- Ensure redundant FTD devices are configured for failover to maintain service during an attack
🔍 How to Verify
Check if Vulnerable:
Check FTD software version via CLI: 'show version' and compare against Cisco advisory's affected versions list.Check Version:
show version | include VersionVerify Fix Applied:
After patching, verify version is updated: 'show version' should show a version equal to or higher than the fixed versions listed in Cisco advisory.📡 Detection & Monitoring
Log Indicators:
- Increased packet drop rates in FTD logs
- Snort engine restart messages
- High CPU/memory alerts on FTD device
Network Indicators:
- Sudden increase in TCP traffic to FTD device interfaces
- Unusual traffic patterns from single or multiple sources
SIEM Query:
source="ftd_logs" AND ("packet drop" OR "snort restart" OR "high cpu")🔗 References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-xss-yjj7ZjVq
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sa-ftd-snort-fw-BCJTZPMu
- https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300
