Cisco Adaptive Security Appliance and Firepower Threat Defense Vulnerabilities

On Tuesday, April 24th, 2024, Cisco released advisories concerning multiple high-severity vulnerabilities in their Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software, as part of a response to an ongoing, state-sponsored campaign known as ArcaneDoor. These vulnerabilities, identified as CVE-2024-20353, CVE-2024-20359, and CVE-2024-20358, were actively exploited to deploy malware and execute commands on compromised devices.

Cisco Adaptive Security Appliance and Firepower Threat Defense Vulnerabilities

Severity:

• CVE-2024-20353 - High with a 8.6/10 CVSS
• CVE-2024-20359 - Medium with a 6.0/10 CVSS
• CVE-2024-20358 - Medium with a 6.0/10 CVSS

Exploitation Status: Actively exploited as part of the ArcaneDoor campaign

Impact

CVE-2024-20353

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. 

CVE-2024-20359

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. 

CVE-2024-20353

A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. Administrator-level privileges are required to exploit this vulnerability.

Affected products & remediation

Adaptive Security Appliances

Firepower Threat Defense

Recommendations

Cisco has released software updates to address these vulnerabilities. There are no workarounds. 

References

1. Cisco Releases Security Updates Addressing ArcaneDoor, Vulnerabilities in Cisco Firewall Platforms
2. Cisco CVE-2024-20353 Security Advisory
3. Cisco CVE-2024-20359 Security Advisory
4. Cisco CVE-2024-20358 Security Advisory

What is Digital Hands doing?

For managed customers, Digital Hands is identifying devices with a vulnerable configuration. If a vulnerable configuration is found, we will contact customers to schedule upgrades.

If you are not a Digital Hands customer, we recommend you follow the directions outlined in the Cisco security advisories to update your appliances as soon as possible.