CVE-2024-20359

Cisco ASA and FTD software contain a code-injection flaw (CVE-2024-20359, CWE-94) in a legacy capability used to preload VPN clients and plug-ins, caused by improper validation of a file read from system flash memory. An authenticated local attacker with administrator-level privileges can exploit it by copying a crafted file to the disk0: file system, and after the next device reload the attacker's code executes with root-level privileges. Because the injected code persists across reboots, it enables stealthy, durable control of the device, which led Cisco to raise the Security Impact Rating from Medium to High even though the CVSS 3.1 base score is 6.0 (medium). Any organization running Cisco ASA or FTD on perimeter firewalls or VPN gateways is potentially affected, though exploitation requires administrator access to the device. Exploitation is confirmed in the wild: the flaw was chained with CVE-2024-20353 in the state-sponsored (reportedly China-linked) ArcaneDoor espionage campaign targeting perimeter network devices, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-04-24, with a 19.4% EPSS exploitation probability (97th percentile).

What to do: Upgrade ASA and FTD to the fixed releases specified in Cisco's advisory and apply vendor mitigations per the CISA KEV required action (or discontinue use of the product if mitigations are unavailable). Because a successful exploit leaves code persisting in flash and a reboot does not remove it, audit the disk0: file system for unexpected files, verify device integrity and configuration, and review the Talos ArcaneDoor report for indicators of compromise. Restrict and monitor administrative access, since exploitation requires administrator-level privileges.