CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2024-20260
Advisory Summary
🔐 ALARM High—Cisco Secure Firewall ASA/FTD SSL VPN DoS (Unauthenticated)
Cisco has published an update addressing a High impact denial-of-service vulnerability affecting Cisco Secure Firewall ASA (ASA Software) and Cisco Secure Firewall Threat Defense (FTD Software) platforms. The issue targets the VPN and management web servers, where an unauthenticated remote attacker can degrade or stop SSL VPN connection processing.
- Root cause: Improper memory management for new incoming SSL/TLS connections.
- Exploit method: attacker sends a large number of new SSL/TLS connection attempts.
- Result: the device can run out of system memory or buffer blocks, leading to DoS behavior where SSL VPN processing becomes slow and may cease.
- Service disruption for SSL VPN connectivity and potentially broader platform responsiveness (depending on resource exhaustion behavior).
- Operational recovery may require manual reload if buffers/memory do not reclaim quickly after the attack stops.
- No workarounds are provided to mitigate exploitation.
- Apply Cisco’s released software updates for the affected ASA/FTD software lines as indicated in the advisory.
- Plan for validation windows and potential reload requirements during recovery testing.
- Inventory exposure: identify all deployed ASA/FTD instances (virtual and physical) with SSL VPN enabled.
- Prioritize patching: treat as high urgency due to unauthenticated remote exploitability.
- Harden and observe:
- Tighten network access controls to VPN/management endpoints (ACLs, segmentation, and strict allowlists).
- Add/verify rate limiting and DDoS protections at perimeter/load balancer layers where available.
- Monitor for spikes in new SSL/TLS connection attempts, handshake errors, and signs of memory pressure.
- CVE: CVE-2024-20260
- Security impact rating: High
🔗
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftdvirtual-dos-MuenGnYR?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20SSL%20VPN%20Denial%20of%20Service%20Vulnerability%26vs_k=1
Reference: Vendor Advisory