Vulnerability record · CVE-2024-20353 · published 24 April 2024
CVE-2024-20353: Cisco ASA and FTD web server HTTP header parsing DoS
Cisco · Adaptive Security Appliance Software
Cisco ASA and FTD management and VPN web servers fail to fully check errors when parsing an HTTP header, so a crafted request can crash and reload the device. Because the affected interfaces are internet-facing on many deployments, an unauthenticated remote attacker can repeatedly force outages.
Description
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated remote denial of service on perimeter security devices, listed in KEV with very high EPSS, though impact is availability only.
What it is
Cisco ASA and FTD management and VPN web servers fail to fully check errors when parsing an HTTP header, so a crafted request can crash and reload the device. Because the affected interfaces are internet-facing on many deployments, an unauthenticated remote attacker can repeatedly force outages.
Impact
An attacker gains the ability to cause a denial of service by forcing the device to reload, disrupting VPN and management access for all users of that appliance. No data confidentiality or integrity impact is described.
Attack surface
Reachable over the network via a crafted HTTP request to the management or VPN web server; the CVSS vector shows no privileges or user interaction required. Any device with those web services exposed is a candidate target.
Exploitation
CVE-2024-20353 is listed in CISA KEV with a 2024-05-01 remediation due date, and a third-party advisory reference is tagged Exploit, indicating real-world exploitation. EPSS is very high at roughly 0.71 (99th percentile), consistent with active targeting.
What to do
- Apply the Cisco vendor advisory fixes for ASA and FTD software as the first action.
- If patching cannot be done immediately, follow Cisco's instructions to disable or restrict the affected management and VPN web services, or discontinue use per CISA guidance.
- Restrict HTTP/HTTPS access to the management and VPN web servers to trusted management networks only.
- Monitor for unexpected device reloads and correlate them with inbound HTTP traffic to those interfaces.
- Track the CISA KEV due date and confirm remediation before it passes.
Detection
- Alert on ASA/FTD syslog messages indicating unexpected reloads or crashes and correlate with inbound HTTP requests.
- Review web server access logs on the appliance for malformed or anomalous HTTP headers targeting management/VPN interfaces.
- Monitor for repeated connection attempts or request floods against the management and VPN web services from single sources.
- Baseline normal reload events and investigate any reload without a change ticket or maintenance window.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-20353 to the Known Exploited Vulnerabilities catalog on 24 April 2024 as "Cisco ASA and FTD Denial of Service Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 1 May 2024.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-20353 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-20353), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
