CVE-2024-20402

Q: What is the severity of CVE-2024-20402?

CVE-2024-20402 has a CVSS score of 8.6 (HIGH). A memory management flaw in Cisco ASA and FTD SSL VPN allows unauthenticated remote attackers to trigger device reboots via crafted SSL/TLS packets, causing denial of service. This affects organizations using Cisco ASA or FTD with SSL VPN enabled.

8.6 HIGH

Denial of Service

📋 TL;DR

A memory management flaw in Cisco ASA and FTD SSL VPN allows unauthenticated remote attackers to trigger device reboots via crafted SSL/TLS packets, causing denial of service. This affects organizations using Cisco ASA or FTD with SSL VPN enabled.

💻 Affected Systems

Products:

Cisco Adaptive Security Appliance (ASA) Software
Cisco Firepower Threat Defense (FTD) Software

Versions: Multiple versions - check Cisco advisory for specifics

Operating Systems: Cisco ASA OS, Cisco FTD OS

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects devices with SSL VPN feature enabled

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Continuous DoS attacks causing extended network downtime and service disruption

🟠

Likely Case

Intermittent device reboots disrupting VPN connectivity and network operations

🟢

If Mitigated

Minimal impact with proper network segmentation and monitoring

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending crafted SSL/TLS packets to SSL VPN interface

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Cisco advisory for specific fixed versions

Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-dos-hOnB9pH4

Restart Required: Yes

Instructions:

1. Review Cisco advisory for affected versions 2. Download and apply appropriate fixed software version 3. Reboot device after patching 4. Verify SSL VPN functionality

🔧 Temporary Workarounds

Disable SSL VPN

all

Temporarily disable SSL VPN feature if not required

no webvpn
no enable outside

Restrict SSL VPN Access

all

Limit SSL VPN access to trusted IP ranges using ACLs

access-list SSL_VPN_ACL permit ip <trusted_networks> any
access-group SSL_VPN_ACL in interface outside

🧯 If You Can't Patch

Implement network segmentation to isolate SSL VPN traffic
Deploy intrusion prevention systems to detect and block exploit attempts

🔍 How to Verify

Check if Vulnerable:

Check ASA/FTD version and SSL VPN configuration status

Check Version:

show version

Verify Fix Applied:

Verify running version matches fixed version from Cisco advisory

📡 Detection & Monitoring

Log Indicators:

Unexpected device reloads
SSL VPN connection failures
Memory allocation errors

Network Indicators:

Unusual SSL/TLS traffic patterns to VPN interface
Multiple connection attempts with malformed packets

SIEM Query:

source="cisco_asa" AND (event_id="713172" OR message="%ASA-6-713172")

📊 Metadata

CVE ID: CVE-2024-20402

CVSS v3 Score: 8.6 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE: CWE-788

Published: October 23, 2024

Last Updated: July 15, 2025

🔗 References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-dos-hOnB9pH4 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco

Adaptive Security Appliance Software by Cisco