Cisco ASA and FTD Devices Vulnerable to SSL/TLS Memory Management Memory Flaw

CVE-2024-20402

What is CVE-2024-20402?

A vulnerability exists in the SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software, allowing unauthenticated remote attackers to disrupt device operations through crafted SSL/TLS packets. This logic error in memory management can lead to unexpected device reloads, inducing a denial of service (DoS) condition. Organizations utilizing affected Cisco products should evaluate their exposure and implement relevant security measures to mitigate potential exploits.

References