CVE-2024-20408: Cisco ASA Software DoS Vulnerability

CVE-2024-20408 Overview

Cisco disclosed CVE-2024-20408, a denial-of-service vulnerability affecting the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An authenticated remote attacker holding valid remote access VPN user credentials can send a crafted HTTPS POST request to force the affected device to reload. The root weakness is improper validation of data in HTTPS POST requests [CWE-1287]. Successful exploitation causes the appliance to reload, producing a denial of service (DoS) condition that disrupts perimeter connectivity and VPN termination for all downstream users.

Critical Impact
A single authenticated VPN user can reload the ASA or FTD device, taking down firewall enforcement and remote access services for the entire enterprise perimeter.

Affected Products

Cisco Adaptive Security Appliance (ASA) Software — multiple releases across 9.8.x, 9.12.x, 9.14.x, 9.15.x, 9.16.x, 9.17.x, 9.18.x, 9.19.x, and 9.20.x trains
Cisco Secure Firewall Threat Defense (FTD) Software — versions 6.2.3 through 7.4.1.1
Devices with the Dynamic Access Policies (DAP) feature enabled for remote access VPN

Discovery Timeline

2024-10-23 - CVE-2024-20408 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2024-20408

Vulnerability Analysis

Dynamic Access Policies allow ASA and FTD administrators to enforce per-session VPN posture and authorization decisions based on user, endpoint, and connection attributes. During policy evaluation, the DAP subsystem processes HTTPS POST data submitted by the authenticated VPN client. The affected code paths fail to properly validate object properties inside those POST requests before consuming them, mapping to Improper Validation of Specified Type of Input [CWE-1287].

When the malformed input reaches the parsing routine, the appliance encounters an unrecoverable error and reloads. Because the attacker must authenticate first, exposure scales with the size of the remote access user population, including former employees or compromised credentials that have not been revoked. The scope-changed impact reflects that a single VPN session can crash the shared security appliance and interrupt every tunnel and firewall flow it enforces.

Root Cause

The root cause is improper validation of specified object properties inside HTTPS POST requests processed by the DAP feature. The parser accepts structurally unexpected data without enforcing the required schema, driving the process into a fatal condition that triggers a device reload.

Attack Vector

Exploitation is network-based. An attacker authenticates to the remote access VPN using valid credentials, then transmits a crafted HTTPS POST request that is handled by the DAP evaluation logic. No user interaction on the appliance side is required. Each successful request produces a reload, allowing repeated abuse for sustained denial of service.

No verified public exploit code or proof-of-concept has been published, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Cisco Security Advisory for the authoritative technical description.

Detection Methods for CVE-2024-20408

Indicators of Compromise

Unexpected ASA or FTD device reloads correlated in time with active remote access VPN sessions
Crash files or traceback entries referencing the DAP process on the appliance
Repeated authenticated VPN sessions from the same user account immediately preceding a reload event

Detection Strategies

Correlate show crashinfo output and syslog reload messages with WebVPN and AnyConnect authentication logs to identify the pre-crash session
Alert on any ASA or FTD reload event that is not tied to a scheduled change window or administrative action
Baseline HTTPS POST request patterns to VPN endpoints and flag sessions that immediately precede device instability

Monitoring Recommendations

Forward ASA and FTD syslog, SNMP traps, and crash telemetry to a centralized SIEM for correlation with VPN authentication events
Track per-user VPN session behavior and flag accounts that repeatedly connect just before appliance reloads
Monitor availability of VPN concentrators with active health checks so repeated DoS attempts are detected quickly

How to Mitigate CVE-2024-20408

Immediate Actions Required

Apply the fixed ASA and FTD software releases identified in the Cisco Security Advisory for CVE-2024-20408
Audit remote access VPN accounts and revoke credentials for inactive, former, or suspicious users
Enforce multi-factor authentication on all remote access VPN profiles to reduce the pool of accounts an attacker can abuse
Restrict administrative access to the appliance and ensure crash telemetry is being captured for forensic review

Patch Information

Cisco has released fixed software for both ASA and FTD. Consult the Cisco Security Advisory cisco-sa-asaftd-dap-dos-bhEkP7n to identify the first fixed release for each affected train (9.8.x through 9.20.x for ASA and 6.2.3 through 7.4.1.1 for FTD) and plan upgrades accordingly.

Workarounds

Cisco has not published a configuration workaround; upgrading to a fixed release is the required remediation
As a compensating control, tighten VPN account hygiene by disabling unused accounts and enforcing strong authentication
Deploy redundant VPN head-ends in high-availability or clustered mode so a single reload does not eliminate remote access

bash

# Configuration example: verify current ASA/FTD version and DAP configuration
show version | include Software
show running-config | section dynamic-access-policy-record
show crashinfo