CVE-2024-20359

What it actually does

CVE-2024-20359 is a post-authentication local code execution flaw in a legacy Cisco ASA and Cisco FTD capability used to preload VPN clients and plug-ins. The vulnerability is caused by improper validation of a file read from system flash memory. An attacker who already has administrator-level privileges can copy a crafted file to the disk0: file system; after the next device reload, the appliance may execute attacker-controlled code with root-level privileges. Because the injected code can survive reboots, the issue enables persistent compromise of the security appliance and can alter device behavior below the normal administrative control plane.

Why it matters to the business

A compromised firewall or VPN appliance can undermine network perimeter security, remote-access VPN trust, traffic inspection, and segmentation controls. Although exploitation requires prior administrator-level access, the impact is serious because the attacker can turn that access into persistent root-level control of the appliance, potentially surviving reboots and software restarts. This vulnerability is listed in CISA KEV with a remediation due date of 2024-05-01, and exploitation has been observed in the wild, so unremediated internet-facing or remote-access ASA/FTD deployments should be treated as high-priority exposure even with a CVSS score of 6.0.

How an attack unfolds

An attacker first obtains administrator-level access to an affected Cisco ASA or FTD device through stolen credentials, prior compromise, weak management access controls, or another vulnerability. Using that access, the attacker places a crafted file on the device flash storage, specifically the disk0: file system, in a location or format consumed by the legacy VPN client and plug-in preload functionality. The vulnerability is triggered when the device later reloads and reads the malicious file without sufficient validation. On successful exploitation, attacker-controlled code executes with root-level privileges, allowing the attacker to modify appliance behavior and establish persistence across reboots. In observed real-world activity against Cisco ASA and FTD appliances, this class of compromise has been associated with targeted exploitation of perimeter devices, making post-remediation forensic review important.

How to fix it

Upgrade affected Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software to a Cisco fixed release for the deployed software train as specified in the official Cisco advisory. Because the input does not provide exact fixed versions, validate the correct target version against Cisco’s software checker or advisory before upgrading. Remove unauthorized or unexpected VPN client, plug-in, preload, or other nonstandard files from disk0: only after preserving forensic evidence if compromise is suspected. Restrict administrative access to trusted management networks, require MFA where supported, rotate administrator credentials, review TACACS+/RADIUS/AAA configurations, and ensure only necessary administrators can write to device flash. If exploitation is suspected, perform incident response and consider rebuilding or reimaging the appliance from trusted media rather than relying only on file deletion.

How to confirm the fix worked

Confirm the running ASA or FTD version is not in an affected release and matches a Cisco fixed version for the relevant train. Verify device inventory for all ASA and FTD appliances, including standby, lab, disaster recovery, and remote-office devices. Review disk0: for unexpected files, recently modified files, or files associated with VPN client/plugin preload functionality. Confirm there are no unexplained reloads, configuration changes, or administrative file-copy operations before or after patching. After upgrade, validate that management access controls, AAA logging, configuration backup, and administrative command accounting are enabled and forwarding to centralized logging. Where practical, compare the appliance file system and running configuration against a known-good baseline.

Typical attack path

1. Gain administrator-level access to an affected Cisco ASA or Cisco FTD appliance.
2. Access the local file system or management interface that allows writing to disk0:.
3. Copy a crafted file to the disk0: flash file system where the legacy VPN preload mechanism will process it.
4. Wait for or cause a device reload so the vulnerable file-processing path is invoked.
5. Achieve execution of attacker-controlled code with root-level privileges.
6. Use root-level access to persist, alter appliance behavior, hide activity, or support further network intrusion.

How to detect it

Look for evidence of prior administrator-level compromise followed by writes to the appliance flash file system and a subsequent reload. Relevant sources include Cisco ASA/FTD syslog, device command accounting, TACACS+/RADIUS/AAA logs, FMC audit logs for FTD-managed devices, configuration archive systems, file inventory outputs, crash/reload history, VPN administrative logs, and network management platform logs. Search for administrative sessions that performed file-copy, delete, rename, archive extraction, or disk0: manipulation commands, especially shortly before a reboot. Review disk0: for unexpected files, unusual timestamps, nonstandard VPN client or plug-in preload artifacts, or files not present in a known-good baseline. Correlate this with unexplained reloads, failovers, administrator logins from unusual source IPs, failed/disabled logging, configuration changes, or sudden loss of telemetry. Because successful exploitation may execute as root and persist across reboots, absence of ordinary syslog events is not sufficient to rule out compromise; file-system review, baseline comparison, and credential/access review are important.

• disk0:
• copy disk0:
• copy /noconfirm
• delete disk0:
• rename disk0:
• dir disk0:
• show disk0:
• reload
• write memory
• %ASA-5-111008
• %ASA-5-111010
• %ASA-5-111009
• %ASA-6-113004
• %ASA-6-113005

What your security team should do

• Treat this as urgent for any affected ASA or FTD appliance because it is in CISA KEV, exploitation has been observed in the wild, and the KEV remediation deadline has passed.
• Upgrade all affected ASA and FTD devices to Cisco fixed releases, prioritizing internet-facing VPN and perimeter appliances.
• Preserve logs and disk0: file listings before cleanup if compromise is suspected, because deleting files may destroy forensic evidence.
• Review administrator access history, including local admin logins, TACACS+/RADIUS authentications, privilege changes, and file-copy commands.
• Rotate credentials and secrets used to administer affected appliances, especially if unexplained administrator activity is found.
• Audit disk0: for unexpected VPN client, plug-in, preload, archive, script, or recently modified files.
• Investigate unexplained reloads, failovers, crashes, or configuration changes around the suspected exposure window.
• Restrict appliance management interfaces to hardened jump hosts or management networks and block broad internet access to administrative services.
• If signs of compromise exist, engage incident response, consider appliance reimage/rebuild from trusted media, and assess downstream network access that the appliance could have enabled.