CVE-2024-20297: Cisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect

Description

A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. An attacker could exploit this vulnerability by establishing an AnyConnect connection to the affected device. A successful exploit could allow the attacker to bypass configured ACL rules.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco Adaptive Security Appliance (ASA) Software

Default version status: unknown

9.12.3affected
9.8.3affected
9.12.1affected
9.8.1affected
9.12.2affected
9.8.2.45affected
9.8.2affected
9.8.4affected
9.14.1affected
9.12.4affected
9.8.2.26affected
9.8.2.24affected
9.8.2.15affected
9.8.2.14affected
9.8.2.35affected
9.8.2.20affected
9.8.2.8affected
9.8.2.17affected
9.8.2.28affected
9.8.2.33affected
9.8.2.38affected
9.8.4.25affected
9.12.3.2affected
9.12.3.7affected
9.8.3.18affected
9.8.3.14affected
9.8.4.15affected
9.8.4.8affected
9.8.1.7affected
9.8.3.29affected
9.14.1.10affected
9.12.2.5affected
9.8.4.22affected
9.12.3.12affected
9.8.4.7affected
9.8.4.17affected
9.8.3.16affected
9.8.4.20affected
9.8.3.11affected
9.12.1.3affected
9.8.4.3affected
9.12.2.4affected
9.8.4.12affected
9.12.1.2affected
9.8.3.26affected
9.8.1.5affected
9.12.2.9affected
9.12.3.9affected
9.8.3.21affected
9.8.4.10affected
9.12.2.1affected
9.12.4.2affected
9.14.1.6affected
9.8.3.8affected
9.14.1.15affected
9.14.1.19affected
9.8.4.26affected
9.12.4.4affected
9.14.1.30affected
9.8.4.29affected
9.12.4.7affected
9.15.1affected
9.14.2affected
9.12.4.8affected
9.8.4.32affected
9.12.4.10affected
9.14.2.4affected
9.15.1.7affected
9.14.2.8affected
9.12.4.13affected
9.8.4.33affected
9.15.1.10affected
9.14.2.13affected
9.8.4.34affected
9.12.4.18affected
9.15.1.15affected
9.8.4.35affected
9.14.2.15affected
9.12.4.24affected
9.16.1affected
9.15.1.16affected
9.8.4.39affected
9.14.3affected
9.12.4.26affected
9.16.1.28affected
9.14.3.1affected
9.12.4.29affected
9.14.3.9affected
9.16.2affected
9.12.4.30affected
9.16.2.3affected
9.8.4.40affected
9.14.3.11affected
9.15.1.17affected
9.12.4.35affected
9.8.4.41affected
9.15.1.1affected
9.14.3.13affected
9.16.2.7affected
9.12.4.37affected
9.14.3.15affected
9.17.1affected
9.16.2.11affected
9.14.3.18affected
9.16.2.13affected
9.12.4.39affected
9.12.4.38affected
9.8.4.43affected
9.14.4affected
9.16.2.14affected
9.17.1.7affected
9.12.4.40affected
9.15.1.21affected
9.16.3.3affected
9.14.4.6affected
9.16.3affected
9.16.3.14affected
9.17.1.9affected
9.14.4.7affected
9.12.4.41affected
9.17.1.10affected
9.8.4.44affected
9.18.1affected
9.12.4.47affected
9.14.4.12affected
9.16.3.15affected
9.18.1.3affected
9.17.1.11affected
9.12.4.48affected
9.14.4.13affected
9.18.2affected
9.16.3.19affected
9.17.1.13affected
9.12.4.50affected
9.14.4.14affected
9.17.1.15affected
9.8.4.45affected
9.12.4.52affected
9.14.4.15affected
9.16.3.23affected
9.18.2.5affected
9.16.4affected
9.12.4.54affected
9.14.4.17affected
9.8.4.46affected
9.17.1.20affected
9.18.2.7affected
9.19.1affected
9.16.4.9affected
9.12.4.55affected
9.18.2.8affected
9.14.4.22affected
9.16.4.14affected
9.8.4.48affected
9.18.3affected
9.19.1.5affected
9.14.4.23affected
9.12.4.56affected
9.16.4.18affected
9.17.1.30affected
9.19.1.9affected
9.18.3.39affected
9.16.4.19affected
9.12.4.58affected
9.19.1.12affected
9.18.3.46affected
9.16.4.27affected
9.18.3.53affected
9.16.4.38affected
9.17.1.33affected
9.12.4.62affected
9.16.4.39affected
9.16.4.42affected
9.16.4.48affected
9.12.4.65affected
9.16.4.55affected
9.17.1.39affected
9.12.4.67affected
9.14.4.24affected

Cisco Cisco Firepower Threat Defense Software

Default version status: unknown

6.2.3.14affected
6.4.0.1affected
6.2.3.7affected
6.2.3affected
6.4.0.2affected
6.2.3.9affected
6.2.3.1affected
6.2.3.2affected
6.4.0.5affected
6.2.3.10affected
6.4.0affected
6.4.0.3affected
6.2.3.6affected
6.4.0.4affected
6.2.3.15affected
6.2.3.5affected
6.2.3.4affected
6.2.3.3affected
6.2.3.8affected
6.4.0.6affected
6.2.3.11affected
6.2.3.12affected
6.2.3.13affected
6.4.0.7affected
6.4.0.8affected
6.6.0affected
6.4.0.9affected
6.2.3.16affected
6.6.0.1affected
6.6.1affected
6.4.0.10affected
6.7.0affected
6.4.0.11affected
6.6.3affected
6.7.0.1affected
6.6.4affected
6.4.0.12affected
6.7.0.2affected
7.0.0affected
6.2.3.17affected
7.0.0.1affected
6.6.5affected
7.0.1affected
7.1.0affected
6.4.0.13affected
6.6.5.1affected
6.2.3.18affected
7.0.1.1affected
6.7.0.3affected
6.4.0.14affected
7.1.0.1affected
6.6.5.2affected
7.0.2affected
6.4.0.15affected
7.2.0affected
7.0.2.1affected
7.0.3affected
6.6.7affected
7.1.0.2affected
7.2.0.1affected
7.0.4affected
7.2.1affected
7.0.5affected
6.4.0.16affected
7.3.0affected
7.2.2affected
7.2.3affected
6.6.7.1affected
7.3.1affected
7.1.0.3affected
7.2.4affected
7.0.6affected
7.2.5affected
7.2.4.1affected
7.3.1.1affected
6.4.0.17affected
7.0.6.1affected
6.6.7.2affected
6.4.0.18affected
7.3.1.2affected

CVE-2024-20297

Cisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass Vulnerability

Description

Affected products

Cisco Cisco Adaptive Security Appliance (ASA) Software

Cisco Cisco Firepower Threat Defense Software

References