CVE-2024-20353 is a denial of service vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). CISA added it to the Known Exploited Vulnerabilities catalogue on 24 April 2024, which means attackers have used it in real attacks.
What makes this kind of Cisco ASA and FTD flaw dangerous?
A denial of service in perimeter security appliances is dangerous because it can take the device out of the traffic path, interrupting inspection, routing, VPN termination, or policy enforcement. For ASA and FTD, that means a single exploitable flaw can become an availability problem for the network edge, not just for the appliance itself.
In practical terms, this kind of issue can affect remote access users, site-to-site connectivity, and any service that depends on the firewall remaining stable under load or malformed traffic. The key concern is not data theft but forced disruption at a point where many other services converge.
How organisations assess exposure to a KEV-listed appliance vulnerability
Exposure checks start with accurate asset inventory and a clear view of where ASA and FTD are deployed, including internet-facing instances, remote-access concentrators, and devices buried in branch or partner networks. Security teams should then compare those assets against the vendor advisory and the CISA KEV catalogue rather than relying on the CVE name alone, because those sources carry the authoritative product and remediation details.
The practical question is whether the vulnerable software is reachable in a way that an attacker can trigger reliably. Internet exposure, administrative exposure, and high-availability pair configurations all matter because a denial of service on one node can still cause user-visible outage or failover instability.
Remediation and compensating controls when patching is delayed
The preferred response is to apply the vendor fix as soon as operationally possible, but availability-critical appliances often need a staged maintenance window. Until then, organisations can reduce exposure by restricting management access, limiting unnecessary inbound reachability, tightening segmentation around the firewall, and monitoring for abnormal CPU, session, or crash behaviour.
Where a patch cannot be applied immediately, compensating controls should focus on reducing the attack surface and preserving service continuity. That usually means protecting the appliance from unsolicited internet traffic where feasible, validating failover behaviour, and ensuring that rollback and recovery steps are ready before work begins.
Detection and post-incident review
Denial of service events on edge appliances can look like routine instability unless teams review logs, process restarts, failed connections, and sudden drops in throughput together. Detection should look for repeated crashes, unusual connection storms, and patterns that align with traffic-triggered exhaustion or service interruption.
After remediation, organisations should review whether the device was merely disrupted or whether it was probed repeatedly before the outage. Even when the vulnerability is not about credential theft, the incident review should confirm that no adjacent management channels, VPN sessions, or administrative access paths were abused during the disruption.
Risk and Threat Considerations
This vulnerability matters because perimeter appliances are often single points of failure for large user groups and critical remote services. A successful denial of service can rapidly become a business outage, especially where the firewall also supports VPN access, segmentation, or branch connectivity.
Failure mechanism: The attacker triggers a condition that exhausts resources, destabilises the appliance process, or forces the device into an unresponsive state, reducing or eliminating network availability.
Impact: Users may lose access to internal services, remote connectivity may fail, and failover or recovery operations may be disrupted until the appliance is restored.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE is KEV-listed and needs prioritized vulnerability handling. |
| Recommendation — Prioritise remediation of the KEV-listed Cisco appliance flaw and verify exposure across the asset inventory. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment and remediation tracking are central to this exploited vulnerability. |
| Recommendation — Track the vulnerable Cisco ASA and FTD assets, validate exposure, and confirm remediation status. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find anomalies | Detection of appliance instability and abnormal network behaviour is material to this DoS flaw. |
| PR.PS-01 — Configurations are managed, consistent with policies and procedures | Compensating controls and hardened appliance exposure depend on secure configuration management. | |
| Recommendation — Monitor edge network services for instability, crashes, and anomalous traffic patterns tied to the flaw. Tighten the appliance configuration and restrict unnecessary exposure until patching is complete. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | This vulnerability requires disciplined identification, prioritisation, and treatment of a known exploited flaw. |
| Recommendation — Manage the Cisco ASA and FTD vulnerability as a known technical vulnerability with documented treatment. | ||
Practitioner Guidance
Why practitioners should care: Treat a KEV-listed denial of service on ASA or FTD as an operational resilience issue, not just a routine vulnerability ticket. The right response is to prioritise it according to where the appliance sits in the traffic path and how much of the business depends on it.
What to watch for: Focus on reachability, crash patterns, and whether the vulnerable appliance is exposed to untrusted networks. If the device fronts VPN, partner access, or core segmentation, the risk is materially higher than for an isolated test box.
Related resources from NHI Mgmt Group
- CVE-2024-20481 (Cisco ASA and FTD Denial-of-Service)
- CVE-2026-20349 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection)
- CVE-2025-20333 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow)
- CVE-2018-0154 (Cisco IOS Software Integrated Services Module for VPN Denial-of-Service)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org