Cisco ASA/FTD Persistent Local Code Execution (CVE-2024-20359)

medium Tenable OT Security Plugin ID 505545

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plugins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges.
Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0:
file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. This vulnerability affects the confidentiality, integrity, and availability of the affected device. Note: This vulnerability was publicly disclosed in conjunction with the ArcaneDoor state-sponsored espionage campaign that targeted perimeter network devices.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: Medium

ID: 505545

File Name: tenable_ot_cisco_CVE-2024-20359.nasl

Version: 1.1

Type: Remote

Family: Tenable.ot

Published: 7/20/2026

Updated: 7/20/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: High

Score: 8.9

Percentile: 99.7

CVSS v3

Risk Factor: Medium

Base Score: 6

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Vulnerability Information

CPE: cpe:/o:cisco:adaptive_security_appliance_software, cpe:/o:cisco:firepower_threat_defense

Required KB Items: Tenable.ot/Cisco

Patch Publication Date: 4/24/2024

Vulnerability Publication Date: 4/24/2024

CISA Known Exploited Vulnerability Due Dates: 5/1/2024

Reference Information

CVE: CVE-2024-20359

CWE: 94

Detections

Analytics