Secuno
ENNL
Book demo

CVE-2024-20353

Cisco ASA and FTD Denial of Service

8.6 HIGHActively exploited (CISA KEV)Public exploitEPSS 70.7%
  1. Published24 Apr 2024
  2. Added to CISA KEV24 Apr 2024
  3. Remediation due1 May 2024
Actively exploited (CISA KEV)

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.

Added to KEV: 24 Apr 2024Federal remediation due: 1 May 2024

Description

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Cisco Secure Firewall Threat Defense6.2.3 · 6.2.3.1 · 6.2.3.10 · 6.2.3.11
Cisco Adaptive Security Appliance Software9.12.1 · 9.12.1.2 · 9.12.1.3 · 9.12.2

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-201548.6
A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco…
CVE-2026-314489.4
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid…
CVE-2026-255338.8
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior…
CVE-2025-681378.3
EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer…
CVE-2025-551188.9
Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS…
CVE-2025-202538.6
A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure…

Frequently asked

Is CVE-2024-20353 being actively exploited?

Yes. CVE-2024-20353 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 Apr 2024.

How severe is CVE-2024-20353?

CVE-2024-20353 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 70.7% probability of exploitation.

Which products are affected by CVE-2024-20353?

Affected products include Cisco Secure Firewall Threat Defense, Cisco Adaptive Security Appliance Software.

How do I fix CVE-2024-20353?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-20353 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.