CVE-2024-20299

MediumCVSS 5.8/10Last modified Aug 11, 2026

Description

A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. An attacker could exploit this vulnerability by establishing an AnyConnect connection to the affected device. A successful exploit could allow the attacker to bypass configured ACL rules.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-290

Affected software

VendorProductVersions
CiscoCisco Adaptive Security Appliance (ASA) Software9.12.3; 9.8.3; 9.12.1; 9.8.1; 9.12.2; 9.8.2.45; 9.8.2; 9.8.4; 9.14.1; 9.12.4; 9.8.2.26; 9.8.2.24; 9.8.2.15; 9.8.2.14; 9.8.2.35; 9.8.2.20; 9.8.2.8; 9.8.2.17; 9.8.2.28; 9.8.2.33
CiscoCisco Firepower Threat Defense Software6.2.3.14; 6.4.0.1; 6.2.3.7; 6.2.3; 6.4.0.2; 6.2.3.9; 6.2.3.1; 6.2.3.2; 6.4.0.5; 6.2.3.10; 6.4.0; 6.4.0.3; 6.2.3.6; 6.4.0.4; 6.2.3.15; 6.2.3.5; 6.2.3.4; 6.2.3.3; 6.2.3.8; 6.4.0.6
ciscoadaptive_security_appliance_software>= 9.8.1, <= 9.8.4.48; 9.19.1; >= 9.18.1, <= 9.18.2.8; >= 9.17.1, <= 9.17.1.20; >= 9.16.1, <= 9.16.4.9; >= 9.15.1, <= 9.15.1.21; >= 9.14.1, <= 9.14.4.17; >= 9.12.1, <= 9.12.4.55
ciscofirepower_threat_defense_software>= 6.2.3, <= 6.7.0.3; >= 7.0.0, <= 7.3.1.2

References

Timeline

Published
Oct 23, 2024
Last modified
Aug 11, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-20306.4The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin'sCVE-2024-203005.4A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoCVE-2024-203016.2A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary auCVE-2024-203024.3A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attacCVE-2024-203037.4A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauCVE-2024-203047.5A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attaCVE-2024-203054.8A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cCVE-2024-203066.7A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker CVE-2024-203077.5A vulnerability in the IKEv1 fragmentation code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacCVE-2024-203087.5A vulnerability in the IKEv1 fragmentation code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacCVE-2024-203095.5A vulnerability in auxiliary asynchronous port (AUX) functions of Cisco IOS XE Software could allow an authenticated, local attacker to causCVE-2024-20315.4The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meet