CVE-2024-20353
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software…
- Severity
- 8.6 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 69.82%
- Chance of exploitation in the next 30 days. Higher than 99.37% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Apr 24, 2024
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
- None yet
- No fixed version published
Description
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Other links
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog
- Published
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, CWE-835 |
| GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries | High | Same weakness, CWE-835 |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) | Low | Same weakness, CWE-835 |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) | Medium | Same weakness, CWE-835 |
| EEF-CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | Not rated yet | Same weakness, CWE-835 |
| GHSA-3j72-p6qg-6xp7 Pillow: TarIO negative size field causes infinite CPU-spin loop | Medium | Same weakness, CWE-835 |
| GHSA-39mj-jf6j-2qj3 pypdf: Possible infinite loop when hitting EOF in standard xref table | Medium | Same weakness, CWE-835 |
| GHSA-9mx8-4j7g-633p pypdf: Possible infinite loop when removing tree items | Medium | Same weakness, CWE-835 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor