CVE-2024-20261: Cisco Secure Firewall File Policy Bypass

CVE-2024-20261 Overview

CVE-2024-20261 is a file policy bypass vulnerability in Cisco Firepower Threat Defense (FTD) Software. The flaw resides in the file inspection feature that evaluates encrypted archive files against configured policies. An unauthenticated, remote attacker can send a crafted encrypted archive through an affected device and bypass policy enforcement intended to block the file. The vulnerability stems from a logic error when inspecting a specific class of encrypted archives. Successful exploitation lets malicious content traverse the firewall unmodified, undermining perimeter malware controls. Cisco published the advisory on May 22, 2024, and the issue is tracked under [CWE-284: Improper Access Control].

Critical Impact
Attackers can smuggle malware-bearing encrypted archives past Cisco FTD file policies that were explicitly configured to drop them, defeating a layer of perimeter defense.

Affected Products

Cisco Secure Firewall Threat Defense 6.2.3 through 6.2.3.18
Cisco Secure Firewall Threat Defense 6.4.0 through 6.7.0.3 and 7.0.x through 7.0.5
Cisco Secure Firewall Threat Defense 7.1.x, 7.2.0 through 7.2.4, and 7.3.0 through 7.3.1.2

Discovery Timeline

2024-05-22 - CVE-2024-20261 published to NVD and Cisco Security Advisory released
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2024-20261

Vulnerability Analysis

Cisco FTD applies file policies to decide whether traffic-borne files should be inspected, allowed, or blocked. For encrypted archives, the device cannot read the contents but can still match on archive type and enforce block actions. CVE-2024-20261 breaks that enforcement for a specific category of encrypted archive formats. When the inspection engine processes one of these files, a logic error short-circuits the block action, allowing the archive to transit the device. Because the attacker never needs to authenticate and the attack reaches the device over the network, any environment relying on FTD to drop encrypted archives at ingress is exposed. The functional impact is a loss of containment: malware packaged inside the affected archive class reaches internal hosts despite a policy that should have stopped it.

Root Cause

The root cause is a logic error in the file policy inspection code path that handles a specific class of encrypted archive files. The engine fails to apply the configured block-and-drop action, resulting in improper access control ([CWE-284]). Cisco has not publicly identified the exact archive format in order to limit exploitation detail.

Attack Vector

Exploitation is remote and unauthenticated. An attacker crafts an encrypted archive matching the vulnerable class and transmits it through the FTD device over any inspected protocol, such as HTTP, HTTPS with TLS decryption, SMTP, or FTP. No user interaction on the firewall is required. The archive bypasses the block action and is delivered to the recipient. The attacker still needs the recipient to open the archive and extract the payload for end-to-end compromise, which bounds the direct integrity impact. See the Cisco Security Advisory: FTD Archive Bypass for the vendor description.

Detection Methods for CVE-2024-20261

Indicators of Compromise

Encrypted archive files (ZIP, 7z, RAR variants) arriving on internal hosts despite an FTD file policy that should have blocked them.
Mismatch between FTD connection event logs showing archive file types and the absence of corresponding file-block events.
Downstream endpoint identifications of malware extracted from password-protected archives that transited the perimeter.

Detection Strategies

Correlate FTD file event logs with endpoint telemetry to identify encrypted archives that reached endpoints without a matching block action.
Hunt in web and mail proxy logs for encrypted archive deliveries that FTD inspected but did not drop.
Use endpoint detection and response data to flag extractions of password-protected archives originating from external senders.

Monitoring Recommendations

Forward FTD file and malware events to a centralized data lake and alert on policy actions of Detect where Block was expected for encrypted archives.
Monitor Cisco FTD software versions against the fixed release list in the vendor advisory to detect unpatched devices.
Track inbound email and web traffic volume for encrypted archive attachments and investigate anomalous spikes.

How to Mitigate CVE-2024-20261

Immediate Actions Required

Upgrade Cisco FTD to a fixed release identified in the Cisco Security Advisory: FTD Archive Bypass.
Inventory all FTD appliances and virtual instances against the affected version list and prioritize internet-facing devices.
Validate that file and malware policies are applied to the relevant access control rules after the upgrade.

Patch Information

Cisco released fixed software versions concurrent with the May 22, 2024 advisory. Customers with service contracts should obtain updated FTD images through the Cisco Software Center. There are no workarounds that fully address this issue; the vendor directs administrators to upgrade.

Workarounds

No vendor-supplied workaround exists. Cisco explicitly states that only upgrading to a fixed release resolves the vulnerability.
As a compensating control, configure mail and web gateways upstream or downstream of FTD to block or quarantine password-protected archives from untrusted senders.
Increase endpoint protection posture so that any archive that reaches a user is scanned at extraction time, reducing the likelihood that bypassed files execute.

bash

# Verify running FTD software version from the FTD CLI
show version

# From FMC, list managed devices and software versions
# System > Updates > Product Updates, then confirm each device is on a fixed release