CVE-2024-20353

HighCVSS 8.6/10Known exploited (CISA KEV)Last modified Aug 11, 2026

Description

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Apr 24, 2024
Last modified
Aug 11, 2026
Added to CISA KEV
Apr 24, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-203547.4A vulnerability in the handling of encrypted wireless frames of Cisco Aironet Access Point (AP) Software could allow an unauthenticated, adjCVE-2024-203555.0A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance (CVE-2024-203568.7A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote aCVE-2024-203575.9A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an CVE-2024-203586.7A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco FirepCVE-2024-203596.0A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco AdapCVE-2024-20364.3The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing caCVE-2024-203608.8A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoCVE-2024-203615.8A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allowCVE-2024-203626.1A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could alCVE-2024-203635.8Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unautCVE-2024-203645.4A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remo
CVE-2024-20353: High severity, CVSS 8.6 | Vulnix