Lucene search

CiscoCVE-2024-20293

HistoryMay 22, 2024 - 5:16 p.m.

CVE-2024-20293

2024-05-2217:16:13

CWE-436

cisco

web.nvd.nist.gov

vulnerability

acl

activation

cisco

asa

ftd

bypass

remote

protection

logic error

configuration

exploit

ipv4

ipv6

dual-stack

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

AI Score

6.9

Confidence

Low

EPSS

Percentile

9.0%

JSON

A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to a logic error that occurs when an ACL changes from inactive to active in the running configuration of an affected device. An attacker could exploit this vulnerability by sending traffic through the affected device that should be denied by the configured ACL. The reverse condition is also true—traffic that should be permitted could be denied by the configured ACL. A successful exploit could allow the attacker to bypass configured ACL protections on the affected device, allowing the attacker to access trusted networks that the device might be protecting. Note: This vulnerability applies to both IPv4 and IPv6 traffic as well as dual-stack ACL configurations in which both IPv4 and IPv6 ACLs are configured on an interface.

Affected configurations

Vulners

Node

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.19.1

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.19.1.5

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.19.1.9

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.19.1.12

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.19.1.18

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.19.1.22

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.19.1.24

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.20.1

ciscocisco_adaptive_security_appliance_\(asa\)_softwareMatch9.20.1.5

ciscofirepower_threat_defense_softwareMatch7.3.0

ciscofirepower_threat_defense_softwareMatch7.3.1

ciscofirepower_threat_defense_softwareMatch7.3.1.1

ciscofirepower_threat_defense_softwareMatch7.3.1.2

ciscofirepower_threat_defense_softwareMatch7.4.0

VendorProductVersionCPE
ciscocisco_adaptive_security_appliance_\(asa\)_software9.19.1cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1:*:*:*:*:*:*:*
ciscocisco_adaptive_security_appliance_\(asa\)_software9.19.1.5cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.5:*:*:*:*:*:*:*
ciscocisco_adaptive_security_appliance_\(asa\)_software9.19.1.9cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.9:*:*:*:*:*:*:*
ciscocisco_adaptive_security_appliance_\(asa\)_software9.19.1.12cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.12:*:*:*:*:*:*:*
ciscocisco_adaptive_security_appliance_\(asa\)_software9.19.1.18cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.18:*:*:*:*:*:*:*
ciscocisco_adaptive_security_appliance_\(asa\)_software9.19.1.22cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.22:*:*:*:*:*:*:*
ciscocisco_adaptive_security_appliance_\(asa\)_software9.19.1.24cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.24:*:*:*:*:*:*:*
ciscocisco_adaptive_security_appliance_\(asa\)_software9.20.1cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.20.1:*:*:*:*:*:*:*
ciscocisco_adaptive_security_appliance_\(asa\)_software9.20.1.5cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.20.1.5:*:*:*:*:*:*:*
ciscofirepower_threat_defense_software7.3.0cpe:2.3:a:cisco:firepower_threat_defense_software:7.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.19.1	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1:::::::*
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.19.1.5	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.5:::::::*
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.19.1.9	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.9:::::::*
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.19.1.12	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.12:::::::*
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.19.1.18	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.18:::::::*
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.19.1.22	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.22:::::::*
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.19.1.24	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.19.1.24:::::::*
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.20.1	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.20.1:::::::*
cisco	cisco_adaptive_security_appliance_\(asa\)_software	9.20.1.5	cpe:2.3:a:cisco:cisco_adaptive_security_appliance_\(asa\)_software:9.20.1.5:::::::*
cisco	firepower_threat_defense_software	7.3.0	cpe:2.3:a:cisco:firepower_threat_defense_software:7.3.0:::::::*

Rows per page:

1-10 of 141

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Adaptive Security Appliance (ASA) Software",
    "versions": [
      {
        "version": "9.19.1",
        "status": "affected"
      },
      {
        "version": "9.19.1.5",
        "status": "affected"
      },
      {
        "version": "9.19.1.9",
        "status": "affected"
      },
      {
        "version": "9.19.1.12",
        "status": "affected"
      },
      {
        "version": "9.19.1.18",
        "status": "affected"
      },
      {
        "version": "9.19.1.22",
        "status": "affected"
      },
      {
        "version": "9.19.1.24",
        "status": "affected"
      },
      {
        "version": "9.20.1",
        "status": "affected"
      },
      {
        "version": "9.20.1.5",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Cisco",
    "product": "Cisco Firepower Threat Defense Software",
    "versions": [
      {
        "version": "7.3.0",
        "status": "affected"
      },
      {
        "version": "7.3.1",
        "status": "affected"
      },
      {
        "version": "7.3.1.1",
        "status": "affected"
      },
      {
        "version": "7.3.1.2",
        "status": "affected"
      },
      {
        "version": "7.4.0",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ogsnsg-aclbyp-3XB8q6jX

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

AI Score

6.9

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-20293