Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2024-20353

HighExploitedPublic exploit

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of…

Published Apr 25, 2024 · Updated Aug 11, 2026

Key Facts

Patch immediately
  • CVE-2024-20353 is a high-severity vulnerability (CVSS 8.6 v3.1) affecting Firepower Threat Defense (Cisco), Secure Firewall Threat Defense (Cisco), Adaptive Security Appliance Software (Cisco) and 2 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Apr 24, 2024 and is known to be used in ransomware campaigns. Public exploit code is available.
  • EPSS estimates a 71% probability of exploitation in the next 30 days.
  • No fixed version is listed yet; check the vendor advisory for mitigations.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

71%

Higher than 99.3% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2024-20353 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVApr 24, 2024May 1, 2024Not reported
Industry KEV feedApr 24, 2024May 1, 2024Known
CIRCL KEVApr 24, 2024May 1, 2024Not reported
ENISA EUVDApr 24, 2024n/aNot reported

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Products

349 affected entries in total
ProductAffected versionsFixed in
Firepower Threat DefenseCisco6.2.3, 6.2.3.1, 6.2.3.10, 6.2.3.11, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.15n/a
Secure Firewall Threat DefenseCisco6.2.3, 6.2.3.1, 6.2.3.10, 6.2.3.11, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.15n/a
Adaptive Security Appliance SoftwareCisco9.12.1, 9.12.1.2, 9.12.1.3, 9.12.2, 9.12.2.1, 9.12.2.4, 9.12.2.5, 9.12.2.9n/a
Cisco Adaptive Security Appliance (ASA) Software>= 9.8.1n/a
Cisco Firepower Threat Defense Software>= 6.2.3n/a

Timeline

  1. Added to CISA KEV

    Apr 24, 2024

  2. Added to Industry KEV feed

    Apr 24, 2024

  3. Added to CIRCL KEV

    Apr 24, 2024

  4. Added to ENISA EUVD

    Apr 24, 2024

  5. Publicly disclosed

    Apr 25, 2024

  6. Last updated

    Aug 11, 2026

Weakness Type

  • CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

References

11 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2024-20353 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo