CVE-2024-20359: Cisco ASA Software RCE Vulnerability

CVE-2024-20359 Overview

CVE-2024-20359 is a persistent local code execution vulnerability in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The flaw resides in a legacy capability that previously allowed preloading of VPN clients and plug-ins. An authenticated attacker with administrator-level privileges can exploit the weakness by placing a crafted file on the disk0: file system. On the next device reload, the device executes attacker-supplied code with root-level privileges. Because the injected code persists across reboots, Cisco elevated the Security Impact Rating from Medium to High. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and was leveraged in the ArcaneDoor espionage campaign targeting perimeter network devices.

Critical Impact
Authenticated administrators can install persistent, root-level implants on Cisco ASA and FTD perimeter devices that survive reboots and software reloads.

Affected Products

Cisco Adaptive Security Appliance (ASA) Software — multiple releases across 9.8.x through 9.20.x trains
Cisco Firepower Threat Defense (FTD) Software — releases 6.2.3 through 7.4.1
Devices running the legacy VPN client/plug-in preloading capability with access to disk0:

Discovery Timeline

2024-04-24 - CVE-2024-20359 published to the National Vulnerability Database
2024-04-24 - Cisco publishes security advisory cisco-sa-asaftd-persist-rce-FLsNXF4h
2024-04-24 - Cisco Talos publishes analysis of the ArcaneDoor espionage campaign abusing this vulnerability
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2024-20359

Vulnerability Analysis

The vulnerability is classified under CWE-94: Improper Control of Generation of Code. It affects a legacy preloading mechanism for VPN clients and plug-ins built into ASA and FTD Software. When the device boots or reloads, the platform reads specific files from system flash without adequately validating their contents or authenticity. An attacker who has already obtained administrator credentials can stage a crafted file on disk0: so that, at the next reload, the device parses and executes attacker-controlled code under the root account. Because the staged payload lives in persistent flash storage, it survives reboots, software upgrades within the same train, and most operational recovery procedures. This makes the flaw attractive for long-term implant deployment on perimeter firewalls, where it directly underpinned the ArcaneDoor campaign reported by Cisco Talos.

Root Cause

The root cause is improper validation of a file read from system flash memory during the VPN preload routine. The device trusts the on-disk artifact and does not perform sufficient integrity, signature, or origin checks before processing it as executable content.

Attack Vector

Exploitation requires local, authenticated access with administrator-level privileges. The attacker copies a crafted file to disk0: using standard administrative tooling, then triggers or waits for a device reload. After reload, the injected code executes with root privileges and persists across subsequent restarts. Initial administrative access is typically obtained through credential theft, supply chain compromise, or by chaining a separate authentication-affecting vulnerability such as CVE-2024-20353.

No verified public proof-of-concept code is available. See the
Cisco Security Advisory cisco-sa-asaftd-persist-rce-FLsNXF4h and the
Cisco Talos ArcaneDoor analysis for technical details.

Detection Methods for CVE-2024-20359

Indicators of Compromise

Unexpected or unrecognized files present on the disk0: file system, particularly files referenced by the VPN client/plug-in preload configuration
Unexplained device reloads followed by anomalous administrative behavior or new outbound connections from the appliance
Configuration changes affecting import webvpn commands, custom plug-ins, or anyconnect-custom artifacts
Indicators associated with the ArcaneDoor campaign (Line Runner and Line Dancer implants) as documented in the Cisco Talos ArcaneDoor analysis

Detection Strategies

Run the integrity verification procedures published in the Cisco Security Advisory, including show memory region, core dump analysis, and the forensic guidance Cisco provides for ArcaneDoor
Compare on-device file inventories of disk0: against a known-good baseline taken from a hardened reference device
Correlate administrator login events, copy commands targeting disk0:, and subsequent reload operations in centralized syslog or SIEM data

Monitoring Recommendations

Forward ASA and FTD syslog, AAA, and command accounting data to a centralized analytics platform for long-term retention and correlation
Alert on any write to disk0: performed by interactive administrator sessions outside change windows
Monitor for device reloads that are not associated with an approved change request, especially those preceded by file uploads

How to Mitigate CVE-2024-20359

Immediate Actions Required

Upgrade ASA and FTD Software to a fixed release as listed in the Cisco Security Advisory cisco-sa-asaftd-persist-rce-FLsNXF4h
Rotate all administrator credentials and certificates used on affected appliances, assuming prior compromise where ArcaneDoor indicators are present
Audit disk0: contents and remove any unexpected files; perform forensic capture before deletion
Apply the CISA Known Exploited Vulnerabilities remediation timeline for federal and regulated environments

Patch Information

Cisco has released fixed software versions across the affected ASA and FTD trains. Refer to the Cisco Security Advisory cisco-sa-asaftd-persist-rce-FLsNXF4h for the specific fixed release matching your deployed train. There is no workaround that fully addresses the vulnerability; only upgrading to a fixed release removes the exposure.

Workarounds

Restrict administrative access to ASA and FTD devices to a small set of bastion hosts and enforce multi-factor authentication for all admin accounts
Enable AAA command accounting and ship logs off-device in real time so that file writes to disk0: and reload events are recorded outside the appliance
Periodically validate disk0: contents against a known-good baseline and remove unused VPN plug-ins or preload artifacts

bash

# Example: review disk0: contents and recent administrative activity on ASA
asa# dir disk0:
asa# show running-config | include import webvpn
asa# show running-config | include anyconnect-custom
asa# show logging | include (reload|copy|disk0)

# Hardening: enforce AAA command accounting and remote logging
asa(config)# aaa accounting command privilege 15 default start-stop group TACACS
asa(config)# logging host <mgmt-interface> <siem-collector-ip>
asa(config)# logging trap informational