CVE-2024-20299

Cisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass Vulnerability

Severity
Medium 5.8
CVSS 3.1
Exploited
Not listed
EPSS
0.005
38.9th percentile
Discovered by
Vendor
Published by the vendor
Published
Oct 23, 2024
Assigned by cisco

Description

A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. An attacker could exploit this vulnerability by establishing an AnyConnect connection to the affected device. A successful exploit could allow the attacker to bypass configured ACL rules.

Weakness: CWE-290

Affected products

Vendor Product Category Matched by
Cisco Cisco Adaptive Security Appliance (ASA) Firewall / NGFW cna-assigner
Cisco Cisco Firepower Threat Defense (FTD) Firewall / NGFW cna-assigner
Vendor-reported affected versions (4)
  • Cisco · Cisco Adaptive Security Appliance (ASA) Software
  • Cisco · Cisco Firepower Threat Defense Software
  • cisco · adaptive_security_appliance_software
  • cisco · firepower_threat_defense_software