Vulnerability in Cisco Adaptive Security Appliance Software
CVE-2024-20493
A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary denial of service (DoS) condition. This vulnerability is due to ineffective handling of memory resources during the authentication process. An attacker could exploit this vulnerability by sending crafted packets, which could cause resource exhaustion of the authentication process. A successful exploit could allow the attacker to deny authentication for Remote Access SSL VPN users for several minutes, resulting in a temporary DoS condition.
EPSS: 0.006 (42.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Cisco Adaptive_security_appliance_software — versions 9.8.1, 9.8.1.5, 9.8.1.7
- Cisco Adaptive Security Appliance (Asa) Software — versions 9.8.1, 9.8.1.5, 9.8.1.7
- Cisco Firepower Threat Defense Software — versions 6.2.3, 6.2.3.1, 6.2.3.2
- Cisco Firepower_threat_defense_software — versions 6.2.3, 6.2.3.1, 6.2.3.2
- Cisco Secure_firewall_threat_defense — versions 6.2.3, 6.2.3.1, 6.2.3.2
Weakness classification (CWE)
References
- psirt@cisco.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-20493?
- CVE-2024-20493 is a medium-severity vulnerability in Cisco Adaptive Security Appliance Software, classified under Missing Release of Resource after Effective Lifetime. CVSS score: 5.3/10. Published 2024-10-23.
- How severe is CVE-2024-20493?
- Medium severity. CVSS v3 base score is 5.3 out of 10.