CVE-2024-20384

5.8 MEDIUM

📋 TL;DR

A logic error in Cisco ASA and FTD software's Network Service Group ACL implementation allows unauthenticated remote attackers to bypass configured access control rules. This affects organizations using these firewall platforms with NSG features enabled, potentially allowing unauthorized network traffic.

💻 Affected Systems

Products:

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Versions: Multiple versions - see Cisco advisory for specific affected releases

Operating Systems: Cisco ASA OS, Cisco FTD OS

Default Config Vulnerable: ✅ No

Notes: Only affects configurations using Network Service Group (NSG) ACLs. Standard ACLs are not affected.

📦 What is this software?

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Adaptive Security Appliance Software by Cisco

View all CVEs affecting Adaptive Security Appliance Software →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

Firepower Threat Defense by Cisco

View all CVEs affecting Firepower Threat Defense →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could establish persistent network access, exfiltrate sensitive data, or pivot to internal systems by bypassing critical firewall rules.

🟠

Likely Case

Limited unauthorized network access through specific ports or services that should be blocked by NSG ACLs.

🟢

If Mitigated

Minimal impact if NSG features are not used or if defense-in-depth controls like additional firewall layers and network segmentation are in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires establishing a connection to the affected device, but no authentication or special conditions needed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple fixed versions available - see Cisco advisory for specific releases

Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-nsgacl-bypass-77XnEAsL

Restart Required: Yes

Instructions:

1. Review Cisco advisory for specific fixed versions for your platform. 2. Download appropriate software from Cisco Software Center. 3. Backup configuration. 4. Apply update following Cisco upgrade procedures. 5. Verify functionality post-upgrade.

🔧 Temporary Workarounds

Disable NSG ACLs

all

Replace Network Service Group ACLs with standard ACLs that are not affected by this vulnerability

Copy

# Replace NSG ACL references with standard ACLs in configuration
# Example: no access-group NSG_ACL_NAME in interface
# Configure standard ACLs instead

🧯 If You Can't Patch

• Implement additional firewall layers or network segmentation to limit potential bypass impact
• Monitor network traffic for unexpected connections that should be blocked by NSG ACLs

🔍 How to Verify

Check if Vulnerable:

Copy

Check if NSG ACLs are configured: 'show running-config | include access-group.*nsg' or 'show running-config | include object-group.*network.*service'

Check Version:

Copy

show version

Verify Fix Applied:

Copy

Verify software version is patched: 'show version' and confirm version matches fixed releases in Cisco advisory

📡 Detection & Monitoring

Log Indicators:

• Unexpected successful connections through interfaces with NSG ACLs
• Traffic flows that should be blocked according to NSG ACL rules

Network Indicators:

• Traffic passing through firewall on ports/services that should be blocked by NSG ACLs

SIEM Query:

Copy

firewall_allow AND (nsg OR service_group) AND NOT expected_traffic

📊 Metadata

CVE ID: CVE-2024-20384

CVSS v3 Score: 5.8 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

CWE: CWE-290

Published: October 23, 2024

Last Updated: August 1, 2025

🔗 References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-nsgacl-bypass-77XnEAsL Vendor Advisory

📤 Share & Export

Twitter LinkedIn Reddit Copy Link

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-20384, you might also want to check these:

CVE-2025-66570 10.0

This vulnerability in cpp-httplib allows attackers to inject HTTP headers (REMOTE_ADDR, REMOTE_PORT,...

Same vulnerability type (CWE-290)

CVE-2022-2310 10.0

CVE-2022-2310 is an authentication bypass vulnerability in Skyhigh Secure Web Gateway (SWG) that all...

Same vulnerability type (CWE-290)

CVE-2020-26276 10.0

This vulnerability allows attackers to modify trusted SAML responses in Fleet osquery manager, enabl...

Same vulnerability type (CWE-290)