CVE-2024-20493: Cisco Secure Firewall Threat Defense DoS

CVE-2024-20493 Overview

CVE-2024-20493 affects the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An unauthenticated, remote attacker can exhaust memory resources in the authentication process by sending crafted packets. Successful exploitation blocks further VPN user authentications for several minutes, producing a temporary denial of service (DoS) condition. The flaw is tracked under CWE-772: Missing Release of Resource after Effective Lifetime and was published to NVD on October 23, 2024. Cisco documented the issue in advisory cisco-sa-asa-vpn-4gYEWMKg.

Critical Impact
Remote, unauthenticated attackers can disrupt Remote Access SSL VPN login for several minutes, preventing legitimate users from establishing VPN sessions.

Affected Products

Cisco Adaptive Security Appliance (ASA) Software, multiple 9.x trains including 9.8, 9.12, 9.14, 9.15, 9.16, 9.17, 9.18, 9.19, and 9.20
Cisco Secure Firewall Threat Defense (FTD) Software, versions 6.2.3 through 7.4.2
Devices configured with the Remote Access SSL VPN feature enabled

Discovery Timeline

2024-10-23 - CVE-2024-20493 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2024-20493

Vulnerability Analysis

The vulnerability resides in the login authentication logic of the Remote Access SSL VPN feature. The authentication process does not properly release memory resources consumed during inbound login handling. An attacker reaches the affected code path over the network without credentials and without user interaction. Repeated delivery of crafted packets forces the authentication subsystem into resource exhaustion. Once exhausted, the appliance rejects or stalls additional VPN authentication attempts until internal state recovers, typically after several minutes.

The scope is availability only. Exploitation does not grant code execution, does not bypass authentication, and does not disclose data. However, availability loss on a Remote Access VPN concentrator can cut off remote workforces, administrators, and site-to-user tunnels used for break-glass access.

Root Cause

The root cause is ineffective handling of memory resources during authentication processing, mapped to CWE-772. Allocations made while parsing or validating login requests are not consistently released, allowing an attacker to drive the authentication process into a starved state through repeated requests.

Attack Vector

The attack is remote and unauthenticated. An attacker sends crafted packets to the SSL VPN login endpoint exposed on the ASA or FTD device. The requests do not require valid credentials because the resource leak occurs before authentication completes. Any ASA or FTD device with Remote Access SSL VPN reachable from an untrusted network is in scope.

No public proof-of-concept code has been published for CVE-2024-20493.
Cisco describes exploitation as sending crafted packets to the Remote Access
SSL VPN login interface, triggering resource exhaustion in the authentication
process. See the Cisco advisory cisco-sa-asa-vpn-4gYEWMKg for vendor details.

Detection Methods for CVE-2024-20493

Indicators of Compromise

Sudden spikes in failed or incomplete SSL VPN authentication attempts from one or a small set of source IPs
Legitimate users reporting repeated timeouts or inability to authenticate to the Remote Access VPN during the same window
Elevated memory utilization on ASA or FTD processes handling WebVPN or SSL VPN authentication

Detection Strategies

Monitor ASA and FTD syslog for authentication-related messages such as %ASA-6-113005, %ASA-6-725001, and WebVPN session errors indicating authentication process stress
Correlate network telemetry for abnormal TLS handshake rates and short-lived HTTPS sessions targeting the VPN interface
Baseline normal VPN login volumes and alert on deviations in authentication latency or failure ratios

Monitoring Recommendations

Track show memory and show processes memory output for authentication-related processes on ASA and FTD
Enable NetFlow or encrypted traffic analytics on the outside interface to detect crafted packet patterns toward the VPN endpoint
Centralize ASA and FTD logs in a SIEM and alert on repeated authentication subsystem errors within short time windows

How to Mitigate CVE-2024-20493

Immediate Actions Required

Review the Cisco advisory cisco-sa-asa-vpn-4gYEWMKg and identify affected ASA or FTD versions in your environment
Apply the fixed software releases identified by Cisco for your platform and train
Restrict SSL VPN access to known client address ranges where business requirements allow

Patch Information

Cisco has released fixed software for ASA and FTD. Consult the Cisco Security Advisory cisco-sa-asa-vpn-4gYEWMKg for the first fixed release per train. Upgrade affected 9.x ASA builds and FTD 6.2.3 through 7.4.2 to the Cisco-identified remediated versions.

Workarounds

Apply control-plane access control lists to limit which source networks can reach the SSL VPN login interface
Deploy upstream rate limiting or Remote Access VPN load distribution to reduce the impact of resource exhaustion attempts
Where feasible, prefer IPsec-based remote access or a secondary VPN head-end as a failover for administrative access during an attack

bash

# Example: restrict management and VPN reachability using a control-plane ACL on Cisco ASA
# Replace the placeholder networks with your trusted ranges before applying.
access-list VPN-ALLOW extended permit tcp <trusted-network>/<mask> any eq 443
access-list VPN-ALLOW extended deny tcp any any eq 443
access-group VPN-ALLOW in interface outside control-plane