CVE-2024-20361: Cisco Firewall ACL Auth Bypass Flaw

CVE-2024-20361 Overview

A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass configured access controls on managed devices that are running Cisco Firepower Threat Defense (FTD) Software. This authorization bypass vulnerability stems from incorrect deployment of the Object Groups for ACLs feature from Cisco FMC Software to managed FTD devices in high-availability setups.

Critical Impact

Unauthenticated remote attackers can bypass configured access controls after an affected device is rebooted following Object Groups for ACLs deployment, allowing unauthorized traffic to reach protected network resources.

Affected Products

• Cisco Secure Firewall Management Center 7.1.0 through 7.1.0.3
• Cisco Secure Firewall Management Center 7.2.0 through 7.2.3.1
• Cisco Secure Firewall Management Center 7.3.0 through 7.3.1

Discovery Timeline

• May 22, 2024 - CVE-2024-20361 published to NVD
• August 7, 2025 - Last updated in NVD database

Technical Details for CVE-2024-20361

Vulnerability Analysis

This vulnerability represents an authorization bypass flaw (CWE-264: Permissions, Privileges, and Access Controls) affecting Cisco Firepower Management Center deployments utilizing Object Groups for ACLs in high-availability configurations. The core issue lies in the improper synchronization and deployment of access control policies between the FMC and managed Firepower Threat Defense devices during high-availability failover scenarios.

When administrators configure Object Groups for ACLs and deploy these configurations to FTD devices operating in a high-availability setup, the policy enforcement mechanism fails to properly initialize after a device reboot. This creates a window where access control rules are not correctly applied, effectively leaving the firewall in a permissive state that allows traffic that should otherwise be blocked.

Root Cause

The root cause of this vulnerability is the incorrect deployment mechanism for Object Groups for ACLs from Cisco FMC Software to managed FTD devices specifically within high-availability configurations. The deployment process fails to properly reinstate access control policies after a reboot event, causing a desynchronization between the intended security policy and the actual enforcement state on the FTD device.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by sending traffic through an affected FTD device after it has been rebooted following an Object Groups for ACLs deployment. The attack flow involves:

1. Identifying a target network protected by Cisco FTD devices managed by FMC in a high-availability configuration
2. Waiting for or inducing a reboot event on the affected FTD device
3. Sending network traffic that would normally be blocked by configured ACLs
4. Successfully bypassing access controls to reach protected network resources

The vulnerability allows attackers to send traffic to devices that are expected to be protected by the affected firewall, potentially exposing internal systems to unauthorized access.

Detection Methods for CVE-2024-20361

Indicators of Compromise

• Unexpected network traffic reaching protected resources that should be blocked by firewall ACLs
• Log entries showing traffic permitted through FTD devices that contradicts configured access control policies
• Inconsistencies between FMC-configured policies and actual traffic flow patterns on managed FTD devices in high-availability deployments

Detection Strategies

• Monitor FTD device logs for traffic patterns that should be blocked by configured Object Groups for ACLs
• Compare expected vs. actual traffic flow through high-availability FTD deployments after reboot events
• Implement network traffic analysis to detect unauthorized access to protected network segments
• Review FMC deployment logs for errors or warnings during Object Groups for ACLs deployment to HA pairs

Monitoring Recommendations

• Configure alerting for FTD device reboot events in high-availability configurations
• Implement continuous monitoring of ACL enforcement effectiveness using traffic analysis tools
• Establish baseline traffic patterns to detect anomalous flows that bypass expected access controls
• Deploy SentinelOne Singularity platform to monitor endpoints behind the affected firewall for unauthorized access attempts

How to Mitigate CVE-2024-20361

Immediate Actions Required

• Review all Cisco FMC deployments to identify systems using Object Groups for ACLs with high-availability FTD configurations
• Consult the Cisco Security Advisory for specific patch and remediation guidance
• Implement additional network segmentation and monitoring for critical assets behind affected FTD devices
• Consider temporarily avoiding reboots of affected FTD devices until patches are applied

Patch Information

Cisco has released security updates to address this vulnerability. Administrators should reference the official Cisco Security Advisory for detailed patching instructions and updated software versions. The advisory provides specific guidance on upgrading affected Cisco Secure Firewall Management Center versions 7.1.0 through 7.3.1 to remediated releases.

Workarounds

• Implement additional perimeter security controls to provide defense-in-depth while awaiting patch deployment
• Avoid using Object Groups for ACLs feature on FTD devices in high-availability configurations until patched
• Manually verify ACL enforcement state after any FTD device reboot in HA deployments
• Consider temporarily moving critical access controls to alternative security mechanisms

# Verify FMC version and check for affected configurations
# Access FMC CLI and check current software version
show version

# Review Object Groups for ACLs configuration status
show running-config object-group

# Verify high-availability status on managed FTD devices
show failover state