CISA’s required action for CVE-2024-20353 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.
What the fix means for Cisco ASA and FTD exposure
CVE-2024-20353 is a denial-of-service issue, so the practical goal is not just “install a patch” but to remove the condition that lets the flaw disrupt service. If you can apply Cisco’s security update, do that first. If you cannot, the fallback is to apply Cisco-documented mitigation or stop using the affected deployment path until the exposure is removed.
For internet-facing firewalls and VPN appliances, availability is the security outcome that matters most. A DoS flaw can still become a material business incident when it takes remote access, perimeter filtering, or policy enforcement offline. That is why edge-device exposure and end-of-life planning belong in the same decision, as covered in the Edge Device Security Guide.
When a product is acting as a critical boundary control, “mitigate” often means reducing blast radius as much as eliminating the bug. For a Cisco ASA or FTD deployment, that can include limiting who can reach management planes, removing unnecessary exposure, and validating that the remaining service path is still supportable after the change.
How to confirm whether you are still exposed
Start by inventorying every Cisco ASA and FTD instance, including devices that may be managed by a partner, inherited through a merger, or tucked into a remote site. Then confirm which systems are directly reachable from untrusted networks and which ones are already shielded by upstream controls or segmentation. If you do not know where the device sits, you do not know whether the mitigation is sufficient.
Track the exact software branch and operational role of each appliance, but do not stop at version review. Exposure also depends on how the box is used, whether it is internet reachable, and whether it is still required for business operations. That is the same asset-scope discipline used in Vulnerability Management Guide: find the asset, verify the risk state, then decide whether to remediate or remove it.
If the device is performing remote access or perimeter enforcement, treat that as higher urgency than a dormant internal appliance. An edge system that can drop traffic, terminate VPN sessions, or enforce segmentation has a larger operational impact than a device with a narrow internal role.
What to do if patching must wait
If you cannot apply Cisco’s update immediately, use the vendor’s documented mitigation exactly as published, and validate that it actually reduces exposure in your environment. If no acceptable mitigation exists, the safer choice is to take the device out of service or remove its internet exposure rather than leave a known denial-of-service path open.
Temporary compensating controls should be narrow and testable. That usually means restricting inbound access, reducing attack surface on exposed interfaces, tightening management reachability, and monitoring for instability or service resets. If the appliance supports critical connectivity, make sure you have an operational fallback before you change exposure.
Practitioners should also understand the difference between delaying a patch and accepting a permanent exception. A temporary exception is only defensible when there is a dated remediation plan, a constrained exposure window, and a clear rollback or replacement path. Otherwise, the exception becomes the risk.
Risk and Threat Considerations
Denial-of-service issues on perimeter appliances are high-impact because the target is often a single service that many users depend on. An attacker does not need full compromise to create material damage, and service interruption can cascade into VPN outage, blocked ingress, or loss of security enforcement.
Failure mechanism: The flaw can be triggered to exhaust resources, crash a process, or otherwise destabilise the appliance, especially when the device is reachable from an untrusted network and handling live traffic.
Impact: Expect loss of availability, interrupted remote access or traffic filtering, and possible emergency failover or replacement work that must be executed under outage pressure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Covers finding and remediating the exposed ASA/FTD vulnerability quickly. |
| Recommendation — Prioritise exposed ASA and FTD assets for rapid remediation or compensating controls. | ||
| NIST CSF 2.0 | ID.AM-01 — Asset Inventory | The answer depends on identifying every Cisco ASA and FTD instance before action. |
| Recommendation — Maintain a complete inventory of ASA and FTD appliances so exposure can be confirmed. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This is a vulnerability remediation decision for an identified product flaw. |
| SC-7 — Boundary Protection | Internet exposure and boundary reachability are central to limiting the DoS blast radius. | |
| Recommendation — Apply the vendor fix or approved mitigation for the vulnerable Cisco appliance. Restrict external reachability to the appliance until the flaw is remediated. | ||
| OWASP Non-Human Identity Top 10 | NHI-06 — Insecure Cloud Deployment Configurations | Cisco edge appliances are exposed services where insecure deployment and reachability increase exploitability. |
| Recommendation — Reduce exposure on internet-facing appliances and verify the deployment is not unnecessarily reachable. | ||
Practitioner Guidance
What to prioritise: Triage by exposure first, not by asset count. An internet-facing ASA or FTD carrying production traffic is the first candidate for patching, mitigation, or isolation.
What to verify: Confirm the vendor guidance you applied actually changes the reachable attack surface, and test that remote access, failover, and logging still work after the change. If the mitigation depends on a configuration assumption, validate that assumption on the live device, not just in a change ticket.
Decision rule: If the appliance cannot be patched or mitigated safely, take it out of service or remove its public exposure before the issue becomes an outage. A known DoS condition on an exposed security appliance is usually a higher operational risk than a planned service change.
Practitioner takeaway: For edge security appliances, the right question is whether the vulnerable device can still be safely exposed, not whether the flaw is “only” a denial of service.
Related resources from NHI Mgmt Group
- How do you patch or mitigate CVE-2024-20481 (Cisco ASA and FTD Denial-of-Service)?
- CVE-2024-20353 (Cisco ASA and FTD Denial of Service)
- How do you patch or mitigate CVE-2026-20349 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection)?
- How do you patch or mitigate CVE-2017-12319 (Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service)?