CVE-2024-20359: Cisco ASA and FTD persistent code injection via crafted file preload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA's KEV catalog with confirmed exploitation in the ArcaneDoor campaign and yields persistent root-level code execution, though it requires local administrator privileges.

What it is

Cisco ASA and FTD software fail to properly validate a file read from system flash memory in a legacy VPN client/plug-in preloading capability. An authenticated local attacker with administrator-level privileges can copy a crafted file to disk0: and achieve root-level code execution after the next device reload. Because the injected code persists across reboots, Cisco raised the advisory's Security Impact Rating from Medium to High.

Impact

An attacker with administrator-level access gains root-level code execution on the affected device, allowing alteration of system behavior. The injected code persists across reboots, giving a durable foothold on perimeter network devices.

Attack surface

Reached locally by copying a crafted file to the disk0: file system; the CVSS vector (AV:L/PR:H/UI:N) indicates local access with high privileges required and no user interaction. Exploitation requires administrator-level privileges on the device.

Exploitation

CVE-2024-20359 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2024-04-24, due 2024-05-01), and a Cisco Talos reference is tagged as an exploit tied to the ArcaneDoor espionage campaign. EPSS gives a 30-day probability of 0.19434 (97.2nd percentile), indicating elevated likelihood.

What to do

• Apply the Cisco vendor advisory patches for ASA and FTD software immediately.
• If patching is not possible, apply the mitigations in the Cisco advisory or discontinue use of the affected product per CISA's required action.
• Restrict administrator-level access to ASA and FTD devices to trusted personnel only.
• Monitor and control writes to the disk0: file system on affected devices.
• Review device configurations and flash contents for unexpected files or persistence mechanisms.

Detection

• Monitor for unexpected or crafted files written to the disk0: file system on ASA and FTD devices.
• Audit administrator-level account activity and local access to affected devices.
• Inspect device flash contents and startup behavior for signs of injected code that persists across reloads.
• Correlate device logs with known ArcaneDoor campaign indicators from the Cisco Talos advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.