CVE-2024-20268: Cisco ASA Software SNMP DoS Vulnerability

CVE-2024-20268 Overview

CVE-2024-20268 is a denial of service vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An authenticated, remote attacker can trigger an unexpected device reload by sending a crafted SNMP request over IPv4 or IPv6. The flaw stems from insufficient input validation of SNMP packets and affects SNMP versions 1, 2c, and 3. Exploitation requires a valid SNMP community string or valid SNMPv3 user credentials. Cisco tracks the issue under advisory cisco-sa-asaftd-snmp-dos-7TcnzxTU, and the weakness is classified under [CWE-231].

Critical Impact
A successful exploit reloads the affected security appliance, breaking perimeter security enforcement and interrupting all traffic traversing the device.

Affected Products

Cisco Adaptive Security Appliance (ASA) Software versions 9.14 through 9.20
Cisco Firepower Threat Defense (FTD) Software versions 6.6 through 7.4
Cisco firewall platforms running SNMP with any of versions 1, 2c, or 3 enabled

Discovery Timeline

2024-10-23 - CVE-2024-20268 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20268

Vulnerability Analysis

The vulnerability resides in the SNMP subsystem of Cisco ASA and FTD Software. The subsystem fails to properly validate fields within incoming SNMP protocol data units before processing them. When the malformed input reaches the parsing routine, it triggers an unhandled condition that terminates the SNMP process and forces the device to reload.

Because the SNMP daemon runs as part of the device's core control plane, an unexpected reload interrupts firewall enforcement, VPN termination, and routing. Attackers targeting perimeter devices can use repeated exploitation to sustain an outage against a business-critical network chokepoint. The condition is aligned with [CWE-231] (Improper Handling of Extra Values), which describes software failing to correctly process input containing unexpected fields.

Root Cause

The root cause is insufficient input validation of SNMP packets across all supported protocol versions. Malformed or unexpected values in an SNMP request are not rejected before they reach code paths that assume well-formed input, producing an error state that the process cannot recover from.

Attack Vector

The attack is network-based and requires authentication. For SNMPv1 and SNMPv2c, the attacker needs a valid community string. For SNMPv3, the attacker needs valid user credentials. Once authenticated to the SNMP service, the attacker sends a single crafted SNMP request over IPv4 or IPv6 that triggers the reload. Because SNMP community strings are frequently reused across large fleets, credential compromise on one device can enable outage attacks against many.

No verified public proof-of-concept code is available for CVE-2024-20268.
Refer to the Cisco Security Advisory (cisco-sa-asaftd-snmp-dos-7TcnzxTU)
for authoritative technical details.

Detection Methods for CVE-2024-20268

Indicators of Compromise

Unexpected snmpd or SNMP subsystem crash traces in the ASA or FTD crashinfo files
Unscheduled device reloads correlated with recent inbound SNMP traffic
SNMP authentication events from source addresses that do not match approved management stations
Repeated malformed SNMP GET, GETNEXT, or SET requests targeting UDP port 161

Detection Strategies

Alert on any ASA or FTD reload event that is not preceded by an approved change window
Baseline SNMP polling sources and flag requests originating from IP addresses outside the NMS allow list
Inspect SNMP traffic at aggregation points for oversized varbind lists or malformed BER encoding
Correlate authentication failures on SNMPv3 users against subsequent reload events on the same device

Monitoring Recommendations

Forward ASA and FTD syslog to a centralized SIEM and monitor for %ASA-1- reload and traceback messages
Enable NetFlow or IPFIX on management interfaces to record UDP/161 conversations
Track device uptime as a metric and alert on unexpected resets across the firewall fleet
Review SNMP host and community configuration weekly for unauthorized changes

How to Mitigate CVE-2024-20268

Immediate Actions Required

Apply the fixed ASA and FTD software releases identified in Cisco advisory cisco-sa-asaftd-snmp-dos-7TcnzxTU
Restrict SNMP access to a small, explicit list of trusted management hosts using snmp-server host allow lists and interface ACLs
Rotate all SNMPv1 and SNMPv2c community strings and all SNMPv3 user credentials on affected devices
Migrate any remaining SNMPv1 or SNMPv2c deployments to SNMPv3 with authentication and privacy

Patch Information

Cisco has published fixed software as part of the advisory Cisco Security Advisory - SNMP DoS and the associated Cisco ERP Alert - ERP-75300. Administrators should consult the advisory for the specific fixed release corresponding to their current ASA or FTD train and upgrade via Cisco Software Center. No workaround fully addresses the flaw; upgrading is the vendor-recommended remediation.

Workarounds

Apply strict ACLs on the management interface to permit UDP/161 only from the NMS subnet
Disable SNMP entirely on devices where it is not required with no snmp-server
Terminate SNMPv3 with strong authentication and privacy algorithms and remove unused SNMP users
Segment management traffic onto an out-of-band network unreachable from user or internet-facing zones

bash

# Configuration example: restrict SNMP polling to an approved NMS host
configure terminal
!
! Remove any overly permissive SNMP host entries first
no snmp-server host management 0.0.0.0
!
! Permit only the approved NMS on the management interface
snmp-server host management 10.10.20.15 community <rotated-string> version 2c
!
! Prefer SNMPv3 with auth + priv
snmp-server group NMS-GRP v3 priv
snmp-server user nms-user NMS-GRP v3 auth sha <auth-key> priv aes 256 <priv-key>
!
! Deny SNMP from any other source via interface ACL
access-list MGMT-IN extended permit udp host 10.10.20.15 any eq snmp
access-list MGMT-IN extended deny udp any any eq snmp
access-group MGMT-IN in interface management
end
write memory