CVE-2024-20370

Summary

A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to elevate their administrative privileges to root. The attacker would need valid administrative credentials on the device to exploit this vulnerability. This vulnerability exists because certain system configurations and executable files have insecure storage and permissions. An attacker could exploit this vulnerability by authenticating on the device and then performing a series of steps that includes downloading malicious system files and accessing the Cisco FXOS CLI to configure the attack. A successful exploit could allow the attacker to obtain root access on the device.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.7affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.9affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.10affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.11affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.13affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.15affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.20affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.30affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.33affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.17.1.39affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.1affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.1.3affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.2affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.2.5affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.2.7affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.2.8affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.3affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.3.39affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.3.46affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.3.53affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.3.55affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.3.56affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.4affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.4.5affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.4.8affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.18.4.22affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1.5affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1.9affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1.12affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1.18affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1.22affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1.24affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1.27affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.19.1.28affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.20.1affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.20.1.5affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.20.2affected
CiscoCisco Adaptive Security Appliance (ASA) Software9.20.2.10affected
CiscoCisco Firepower Threat Defense Software7.1.0affected
CiscoCisco Firepower Threat Defense Software7.1.0.1affected
CiscoCisco Firepower Threat Defense Software7.1.0.2affected
CiscoCisco Firepower Threat Defense Software7.1.0.3affected
CiscoCisco Firepower Threat Defense Software7.2.0affected
CiscoCisco Firepower Threat Defense Software7.2.0.1affected
CiscoCisco Firepower Threat Defense Software7.2.1affected
CiscoCisco Firepower Threat Defense Software7.2.2affected
CiscoCisco Firepower Threat Defense Software7.2.3affected
CiscoCisco Firepower Threat Defense Software7.2.4affected
CiscoCisco Firepower Threat Defense Software7.2.4.1affected
CiscoCisco Firepower Threat Defense Software7.2.5affected
CiscoCisco Firepower Threat Defense Software7.2.5.1affected
CiscoCisco Firepower Threat Defense Software7.2.6affected
CiscoCisco Firepower Threat Defense Software7.2.7affected
CiscoCisco Firepower Threat Defense Software7.2.5.2affected
CiscoCisco Firepower Threat Defense Software7.2.8affected
CiscoCisco Firepower Threat Defense Software7.2.8.1affected
CiscoCisco Firepower Threat Defense Software7.3.0affected
CiscoCisco Firepower Threat Defense Software7.3.1affected
CiscoCisco Firepower Threat Defense Software7.3.1.1affected
CiscoCisco Firepower Threat Defense Software7.3.1.2affected
CiscoCisco Firepower Threat Defense Software7.4.0affected
CiscoCisco Firepower Threat Defense Software7.4.1affected
CiscoCisco Firepower Threat Defense Software7.4.1.1affected

Weaknesses

  • CWE-264: Permissions, Privileges, and Access Control

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References