Riskcovery

CVE-2024-20331

Cisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Authentication DoS Vulnerability

State
Published
Severity
6.8 Medium
Published
Oct 23, 2024
Updated
Oct 24, 2024
Reserved
Nov 8, 2023

Read the record on cve.org

Description

A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to prevent users from authenticating.

This vulnerability is due to insufficient entropy in the authentication process. An attacker could exploit this vulnerability by determining the handle of an authenticating user and using it to terminate their authentication session. A successful exploit could allow the attacker to force a user to restart the authentication process, preventing a legitimate user from establishing remote access VPN sessions.

Scores

CVSSScoreVectorSource
3.16.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hcisco

Weaknesses

  • CWE-330 Use of Insufficiently Random Values

Affected Products

ProductVersions
Cisco Adaptive Security Appliance (ASA) SoftwareCisco
  • 9.12.3Affected
  • 9.8.3Affected
  • 9.12.1Affected
  • 9.8.1Affected
  • 9.12.2Affected
  • 9.8.2.45Affected
  • 9.8.2Affected
  • 9.8.4Affected
  • 9.14.1Affected
  • 9.12.4Affected
  • 9.8.2.26Affected
  • 9.8.2.24Affected
  • 9.8.2.15Affected
  • 9.8.2.14Affected
  • 9.8.2.35Affected
  • 9.8.2.20Affected
  • 9.8.2.8Affected
  • 9.8.2.17Affected
  • 9.8.2.28Affected
  • 9.8.2.33Affected
  • 9.8.2.38Affected
  • 9.8.4.25Affected
  • 9.12.3.2Affected
  • 9.12.3.7Affected
  • 9.8.3.18Affected
  • and 163 more versions
Cisco Firepower Threat Defense SoftwareCisco
  • 6.2.3.14Affected
  • 6.4.0.1Affected
  • 6.2.3.7Affected
  • 6.2.3Affected
  • 6.4.0.2Affected
  • 6.2.3.9Affected
  • 6.2.3.1Affected
  • 6.2.3.2Affected
  • 6.4.0.5Affected
  • 6.2.3.10Affected
  • 6.4.0Affected
  • 6.4.0.3Affected
  • 6.2.3.6Affected
  • 6.4.0.4Affected
  • 6.2.3.15Affected
  • 6.2.3.5Affected
  • 6.2.3.4Affected
  • 6.2.3.3Affected
  • 6.2.3.8Affected
  • 6.4.0.6Affected
  • 6.2.3.11Affected
  • 6.2.3.12Affected
  • 6.2.3.13Affected
  • 6.4.0.7Affected
  • 6.4.0.8Affected
  • and 59 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.