Is CVE-2024-20359 (Cisco ASA and FTD Privilege Escalation) being exploited in the wild?

What this means operationally for Cisco ASA and FTD owners

For operators of Cisco ASA and Firepower Threat Defense, the practical question is not only whether the CVE exists, but whether any device is exposed in a way that makes exploitation plausible. Start by inventorying every ASA and FTD instance, confirm which are internet-facing or otherwise reachable by untrusted users, and treat unmanaged remote access paths as high priority until they are verified and constrained.

Because this issue is already in CISA’s KEV catalogue, the control objective is exposure reduction rather than theoretical vulnerability tracking. For edge devices, that usually means verifying administrative reachability, checking whether local privilege boundaries are already hardened, and ensuring logging is sufficient to show whether a device was touched before remediation.

Where a network appliance supports management access from broad trust zones, privilege escalation flaws become much easier to operationalise. That is why NHIMG’s Edge Device Security Guide is relevant here: the same appliance hardening, management exposure, and logging minimums that matter for routers and gateways also matter for ASA and FTD.

Why KEV status changes the response priority

CISA listing means the vulnerability is not just a lab finding or a low-probability issue. In practice, KEV status should move the item ahead of ordinary backlog work and into the same response lane as other actively exploited weaknesses, especially when the affected platform sits at a network boundary or supports remote administration.

The key practitioner implication is that patch timing should be based on exposure and business criticality, not on whether the device has already shown obvious signs of compromise. For privileged network appliances, attackers often benefit from low-friction access to management paths, stale administrative practices, or insufficient segmentation between user traffic and admin control planes.

When an edge platform is under active exploitation pressure, a broader vulnerability process helps more than ad hoc patching. NHIMG’s Vulnerability Management Guide is useful for prioritising KEV-listed issues, setting remediation urgency, and tracking exception handling and verification for devices that cannot be touched immediately.

What to do if patching must wait

If immediate remediation is not possible, reduce the attack surface around the appliance first. That means tightening who can reach management interfaces, removing unnecessary admin exposure, reviewing local administrative accounts, and validating that logging and alerting are capturing privileged events that would reveal abnormal behaviour early.

For Cisco ASA and FTD specifically, the concern is not abstract disclosure but privilege gain on a device that often sits close to sensitive traffic flows. If the appliance cannot be patched quickly, the fallback should be a temporary compensating-control posture: constrain administrative access as much as possible, document the exception, and monitor for unusual configuration or authentication activity.

A useful comparison point is how other exploited Cisco-related weaknesses have been used to gain or extend control over network infrastructure. NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is relevant because it frames the response pattern for actively exploited flaws: emergency mitigation, verification, and follow-up hunting when full remediation lags.

Practitioner Guidance

What to prioritise: Confirm whether any ASA or FTD instance is externally reachable, whether admin access is tightly bounded, and whether the device is covered by a documented remediation owner and timeline. If it is internet-facing or used for remote administration, treat it as urgent.

What to verify: Check for evidence of prior tampering, unexpected privilege changes, new local accounts, altered configuration, and gaps in logs around the period when the device may have been exposed. A clean patch state is not enough if the device cannot prove its own recent integrity.

Practitioner takeaway: For KEV-listed edge-device flaws, the real decision is whether you can prove the appliance was controlled before exploitation pressure became material, and whether you can keep it that way until remediation is complete.

Related resources from NHI Mgmt Group

• How do you patch or mitigate CVE-2024-20359 (Cisco ASA and FTD Privilege Escalation)?
• CVE-2024-20359 (Cisco ASA and FTD Privilege Escalation)
• Is CVE-2024-20481 (Cisco ASA and FTD Denial-of-Service) being exploited in the wild?
• Is CVE-2025-20333 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow) being exploited in the wild?