Vulnerability · Published Oct 23, 2024 · Assigned by cisco
CVE-2024-20297Cisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass Vulnerability
Medium 5.8
In plain English
A medium-severity authentication bypass by spoofing in Cisco Adaptive Security Appliance (ASA) Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. An attacker could exploit this vulnerability by establishing an AnyConnect connection to the affected device. A successful exploit could allow the attacker to bypass configured ACL rules.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Adaptive Security Appliance (ASA) Software | 9.12.39.8.39.12.19.8.19.12.29.8.2.459.8.29.8.4 |
| Cisco | Cisco Firepower Threat Defense Software | 6.2.3.146.4.0.16.2.3.76.2.36.4.0.26.2.3.96.2.3.16.2.3.2 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N