Security readout for executives and security teams
Plain-English summary
CVE-2024-20359 lets someone who already has administrator-level local access to affected Cisco ASA or FTD devices plant code that can run as root after a reload and persist across reboots. This is urgent because perimeter firewalls and VPN appliances are high-value control points, and CISA KEV identifies this CVE as known exploited.
Executive priority
Prioritize within perimeter-device risk management. The vulnerability needs administrator-level access, but successful exploitation can give persistent root-level control over critical security infrastructure. KEV status raises urgency beyond the CVSS medium score.
Technical view
The flaw is improper validation of a file read from flash memory in a legacy VPN client and plug-in preload capability. An authenticated local attacker with administrator privileges can place a crafted file on disk0:. On the next device reload, arbitrary code may execute with root privileges and persist across reboots.
Likely exposure
Organizations running listed Cisco ASA Software or Firepower Threat Defense Software versions are potentially exposed. Practical risk is highest where administrative access to perimeter devices is weakly controlled, credentials are compromised, or devices are part of remote-access VPN and firewall infrastructure.
Exploitation context
Active exploitation is supported by CISA KEV. Cisco Talos also links this vulnerability to ArcaneDoor, an espionage-focused campaign targeting perimeter network devices. The provided evidence indicates post-authentication persistence potential, not unauthenticated remote exploitation.
Researcher notes
Evidence supports a persistence-oriented, post-authentication root code execution issue in Cisco ASA and FTD. The source bundle does not provide fixed-version details or detection indicators, so validation should anchor on Cisco’s advisory and Talos reporting rather than assumptions.
Mitigation direction
- Identify all Cisco ASA and FTD devices and record exact software versions.
- Review Cisco’s advisory for affected and fixed release guidance.
- Upgrade or remediate according to Cisco’s published instructions.
- Restrict and monitor administrative access to ASA and FTD devices.
- Investigate unexpected files or changes on device flash storage.
- Treat suspicious persistence indicators as potential device compromise.
Validation and detection
- Compare deployed ASA and FTD versions against Cisco’s affected-version list.
- Confirm administrative access is limited to trusted operators and paths.
- Review device reload history and unexpected configuration or behavior changes.
- Inspect flash storage for unauthorized or unexplained files.
- Check security monitoring for activity matching Cisco Talos guidance.
- Verify remediation state after any vendor-recommended upgrade or fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-20359 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N0.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- cisco-sa-asaftd-persist-rce-FLsNXF4hCVE reference
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/CVE reference · exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20359CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.