What is the CVSS score of CVE-2024-20353?

CVE-2024-20353 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 24.4%.

Which versions of Adaptive Security Appliance Software are affected by CVE-2024-20353?

CVE-2024-20353 presents significant security risk rated CVSS 8.6. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

Is there a public PoC exploit available for CVE-2024-20353?

Yes, a public proof-of-concept exploit is available for CVE-2024-20353. Prioritise patching immediately. EPSS: 24.4%.

How to fix or mitigate CVE-2024-20353?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Adaptive Security Appliance Software CVE-2024-20353

HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2024-04-24 psirt@cisco.com

Denial Of Service Cisco Adaptive Security Appliance Software Firepower Threat Defense

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 11:20 vuln.today

Added to CISA KEV

Oct 28, 2025 - 13:59 cisa

CISA KEV

PoC Detected

Oct 28, 2025 - 13:59 vuln.today

Public exploit code

CVE Published

Apr 24, 2024 - 19:15 nvd

HIGH 8.6

DescriptionNVD

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.

AnalysisAI

Cisco ASA and FTD management and VPN web servers contain a vulnerability causing device reload through incomplete error checking, exploited alongside CVE-2024-20359 by state-sponsored actors in the 'ArcaneDoor' campaign.

Technical ContextAI

The CWE-835 infinite loop vulnerability in ASA/FTD's web server request handling allows specially crafted requests to trigger incomplete error processing, causing the device to reload. This DoS capability was used as part of a larger campaign involving device compromise.

RemediationAI

Apply Cisco security updates. Run Cisco's Integrity Checker to verify ASA firmware. Check for ArcaneDoor indicators of compromise. Implement out-of-band management for ASA devices.