CVE-2024-20353

What it actually does

The vulnerability is an unauthenticated remote denial-of-service flaw in the Cisco ASA and Cisco FTD management and VPN web servers. Incomplete error checking while parsing an HTTP header allows a crafted HTTP request to trigger an unexpected device reload. The impact is availability-focused: the attacker does not need credentials or user interaction, and successful exploitation can interrupt firewall, VPN, and management-plane services until the appliance completes the reload and returns to service.

Why it matters to the business

Successful exploitation can cause perimeter firewalls or VPN gateways to reboot unexpectedly, disrupting remote access, site-to-site connectivity, traffic inspection, and administrative access. Because this issue is listed in CISA KEV, has active in-the-wild exploitation, a high EPSS score, and a remediation due date that has already passed, internet-exposed ASA or FTD web/VPN services should be treated as urgent operational risk even though the flaw is not known to directly steal data or execute code.

How an attack unfolds

An attacker first identifies Cisco ASA or FTD devices with exposed management or VPN web services, typically over HTTPS. The attacker then sends a specially crafted HTTP request containing a malformed or unexpected header to the targeted web server. Due to incomplete parsing and error handling, the device mishandles the request and reloads unexpectedly. During the reload, firewall forwarding, VPN sessions, and management access may be interrupted. Attackers can repeat the request to cause recurring outages, degrade availability, interfere with incident response, or create operational disruption while other activity occurs elsewhere.

How to fix it

Upgrade affected Cisco ASA Software and Cisco FTD Software to a Cisco-recommended fixed release for the exact platform and train in use, using the Cisco advisory and Cisco Software Checker to select the correct target version. If immediate upgrade is not possible, reduce exposure by disabling unused management or VPN web services, restricting management HTTP/HTTPS access to trusted administrative networks, limiting VPN portal exposure where operationally feasible, applying upstream ACLs or firewall rules to allow only required source ranges, and ensuring high-availability pairs are healthy before maintenance. Because this vulnerability is in KEV and actively exploited, compensating controls should be treated as temporary until patched software is deployed.

How to confirm the fix worked

Validate remediation by confirming the running ASA or FTD software version is no longer in an affected release range according to Cisco’s advisory. Check device configuration for exposed web services, including ASA HTTP server, ASDM, clientless SSL VPN, and remote-access VPN web portals, and verify that only intended interfaces and trusted source ranges can reach them. From an external network, confirm that management/VPN web endpoints are not unnecessarily exposed. Review uptime and reload history after remediation to ensure unexpected reloads have stopped, and monitor for new crashinfo/core files following any attempted requests.

Typical attack path

1. Scan the internet or target address ranges for exposed Cisco ASA or FTD management/VPN web interfaces.
2. Confirm that the device presents a reachable ASA/FTD HTTPS, ASDM, clientless VPN, or remote-access VPN web service.
3. Send a crafted HTTP request with a malformed header to the exposed web server.
4. Trigger an unexpected reload of the appliance.
5. Repeat the request as needed to cause repeated VPN/firewall outages or instability.

How to detect it

To determine whether exploitation already occurred, review ASA/FTD syslog, FMC event data, SNMP/NMS alerts, uptime history, failover logs, VPN session logs, and device local storage for unexpected reloads or crash artifacts. Focus on timestamps immediately before unexplained reloads and look for inbound HTTPS connections to management or VPN web interfaces from unfamiliar or high-volume external sources. Because the malicious HTTP header may be encrypted inside TLS, network sensors may only show repeated TLS sessions or connection attempts to the appliance rather than the exact header content unless TLS inspection or web proxy logging is present. Correlate reload events with VPN mass disconnects, failover transitions, new crashinfo/core files, and spikes in inbound TCP/443 or configured management-port traffic. If active exploitation is suspected, preserve crashinfo files, running logs, configuration, packet captures where available, and upstream firewall/netflow records before rebooting or upgrading.

• crashinfo_
• disk0:/crashinfo_
• bootflash:/crashinfo_
• core.gz
• corefile
• Traceback
• reload reason
• Reload Reason
• System restarted
• System reload
• unexpected reload
• VPN session disconnected
• WebVPN session terminated
• ASDM session
• http server enable
• webvpn enable
• TCP/443 inbound to ASA
• TCP/443 inbound to FTD
• TLS connections to ASA outside interface immediately before reload
• TLS connections to FTD outside interface immediately before reload

What your security team should do

• Immediately inventory all Cisco ASA and Cisco FTD devices and identify those exposing management or VPN web services to untrusted networks.
• Prioritize patching internet-facing or partner-facing ASA/FTD appliances first, especially because the issue is in CISA KEV, is actively exploited, and the KEV due date has passed.
• Use Cisco’s official advisory and Software Checker to determine the correct fixed release for each appliance, then schedule emergency maintenance where needed.
• Restrict HTTPS management access to trusted administrative IP ranges and disable unused ASDM, clientless VPN, or web portal functionality where possible.
• Review HA/failover health before patching so remediation does not create avoidable outages.
• Search logs and device storage for unexplained reloads, crashinfo files, and repeated HTTPS requests immediately preceding reload events.
• Create monitoring for unexpected ASA/FTD reloads, failover events, VPN mass disconnects, and repeated connections to exposed web interfaces from unfamiliar sources.