Yes. CISA added CVE-2024-20353 to its Known Exploited Vulnerabilities catalogue on 24 April 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.
What this means for Cisco ASA and FTD operators
CVE-2024-20353 is not just a theoretical flaw. Cisco ASA and FTD deployments that are exposed or reachable in the wrong way can enter the failure mode described by Cisco and reflected in CISA's KEV listing. For operators, the practical question is whether the affected appliances are on any live service path where a denial of service would create an immediate outage or force a failover event.
Because the issue is an infinite loop leading to remote denial of service, the first operational concern is service continuity, not data theft. That matters on security gateways because the appliance often sits at a choke point for remote access, segmentation, and egress control. If the platform becomes unstable or unavailable, the security impact can extend beyond the device itself to dependent users, tunnels, and upstream controls.
When a vulnerability is already listed in the CISA Known Exploited Vulnerabilities Catalog, the operational assumption should be that exploitation pressure exists and that prioritisation must move ahead of routine maintenance queues.
How to confirm exposure and decide whether the issue is urgent
Start by confirming whether any Cisco ASA or FTD appliance in your environment is internet-facing, externally reachable through management paths, or otherwise placed where remote traffic can trigger the flaw. That includes redundant pairs, remote-access concentrators, branch gateways, and any device that may be reachable from partner networks or VPN users.
Then verify whether the affected product is used as a primary access control point. If the device is taking part in remote access, perimeter filtering, or segmentation, even a brief denial of service can become a business outage rather than a contained technical interruption. In that case, treat the vulnerability as an availability risk to a core control plane, not simply as an edge-device bug.
For version and vendor-specific remediation details, rely on the Cisco advisory and the official CVE record rather than secondary writeups. The important decision is not whether exploitation is possible in general, but whether your specific deployment can absorb downtime if the flaw is triggered before you can apply the fix.
What to do if patching must wait
If you cannot remediate immediately, reduce exposure in ways that limit reachable attack surface and improve recovery speed. Prefer restrictive management access, tight source-IP controls, and separation of administrative paths from normal user traffic. Where possible, ensure you have a tested failover path so an affected appliance does not become a single point of service loss.
Also prepare for the possibility that denial of service is the symptom of more than one condition. Repeated crashes, unusual control-plane resource spikes, and unexplained restarts should be treated as signals to validate whether the device is being probed or stressed in ways that match the vulnerability pattern. For broader triage discipline, Zero-Day and Exploited Vulnerabilities Guide covers the emergency response posture that applies when active exploitation is possible.
Make sure logging, configuration backups, and recovery procedures are current before deferring remediation. On appliances that sit in a critical path, the ability to restore service quickly may matter more than perfect forensic visibility in the first hour.
Risk and Threat Considerations
A remotely triggerable denial of service on a perimeter appliance can be used to interrupt security enforcement, force failover under stress, or create a distraction during broader activity. Even when the flaw is not associated with payload execution or credential theft, availability loss on a gateway can create a wide downstream blast radius because many environments depend on that device for trust boundaries and access continuity.
Failure mechanism: The vulnerable code path can enter an infinite loop, consuming resources until the appliance stops responding or service quality degrades enough to cause outage conditions.
Impact: The likely outcome is loss of availability for VPN, inspection, segmentation, or edge filtering functions, with possible knock-on effects for remote users and connected business services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Exposed edge appliances need hardened configuration and restricted management paths. |
| CIS-12 — Network Infrastructure Management | ASA and FTD are network infrastructure devices whose availability affects enforcement and segmentation. | |
| Recommendation — Harden ASA and FTD management exposure and restrict reachable attack surface. Monitor, maintain, and recover network security appliances with tested procedures. | ||
| NIST CSF 2.0 | RC.RP-01 — Recovery Plan is executed during or after a cybersecurity incident | A KEV-listed denial-of-service flaw requires validated recovery and failover readiness. |
| DE.CM-01 — Networks and network services are monitored to find potentially adverse events | Active exploitation pressure makes monitoring appliance instability and service loss materially important. | |
| Recommendation — Exercise recovery steps so gateway service can be restored quickly after disruption. Monitor edge-device health and alert on repeated instability or unexpected reloads. | ||
| NIST SP 800-53 Rev 5 | SC-5 — Denial of Service Protection | The issue is a remote denial-of-service condition on a security appliance. |
| Recommendation — Apply DoS protections and resilience measures to reduce service interruption risk. | ||
Practitioner Guidance
What to prioritise: Treat externally reachable ASA and FTD devices as the first remediation set, especially where a single appliance failure would interrupt remote access or perimeter enforcement. If you have a pair or cluster, validate whether failover actually protects you from the specific failure mode before assuming high availability removes the risk.
What to verify: Confirm that your monitoring can distinguish a normal reload from repeated service instability, and confirm that rollback or recovery steps are rehearsed. A device that is patched but not recoverable under load still leaves you with an availability problem.
Practitioner takeaway: For this CVE, the key judgement is whether your firewall or VPN appliance is a hard dependency for business connectivity. If it is, exploitability becomes an urgent uptime and resilience issue, not just a vulnerability-management task.
Related resources from NHI Mgmt Group
- Guide: Edge Device Security Guide
- Is CVE-2024-20481 (Cisco ASA and FTD Denial-of-Service) being exploited in the wild?
- How do you patch or mitigate CVE-2024-20353 (Cisco ASA and FTD Denial of Service)?
- CVE-2024-20353 (Cisco ASA and FTD Denial of Service)
- How do you patch or mitigate CVE-2024-20481 (Cisco ASA and FTD Denial-of-Service)?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org