CVE-2024-20526: Cisco ASA Software SSH DOS Vulnerability

CVE-2024-20526 Overview

CVE-2024-20526 is a denial of service (DoS) vulnerability in the Secure Shell (SSH) server of Cisco Adaptive Security Appliance (ASA) Software. An unauthenticated, remote attacker can exhaust SSH resources on an affected device by sending crafted SSH messages. Successful exploitation blocks new SSH connections until the device is manually rebooted.

The flaw stems from a logic error triggered during SSH session establishment. Existing SSH sessions and user traffic remain unaffected, and administrators can still manage the device using Cisco Adaptive Security Device Manager (ASDM). The vulnerability is tracked under [CWE-400] Uncontrolled Resource Consumption and [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
Remote, unauthenticated attackers can permanently disable SSH management access to Cisco ASA devices, requiring a manual reboot to restore administrative connectivity.

Affected Products

Cisco Adaptive Security Appliance Software 9.16.4.67 and 9.16.4.70
Cisco Adaptive Security Appliance Software 9.18.4.40
Cisco Adaptive Security Appliance Software 9.20.3

Discovery Timeline

2024-10-23 - CVE-2024-20526 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20526

Vulnerability Analysis

The vulnerability resides in the SSH server component of Cisco ASA Software. During SSH session establishment, a logic error prevents the server from correctly releasing session-tracking resources when specific message sequences are received. Each malformed session consumes a slot from the SSH resource pool.

Over repeated attempts, the SSH server reaches its maximum concurrent session capacity. At that point, the device rejects all new SSH connection attempts. Existing authenticated SSH sessions continue operating without disruption, and data-plane traffic through the firewall is not affected.

Recovery requires a manual reboot of the affected appliance, since the leaked resources are not reclaimed at runtime. Administrators retain out-of-band management via ASDM, which mitigates operational impact but does not restore SSH access. The issue is classified under Uncontrolled Resource Consumption ([CWE-400]) and Allocation of Resources Without Limits or Throttling ([CWE-770]).

Root Cause

The root cause is a logic error in the SSH session establishment code path. The server fails to properly clean up allocated session resources when it encounters attacker-crafted SSH protocol messages. Repeated exploitation leads to complete exhaustion of the finite SSH connection pool.

Attack Vector

Exploitation requires network reachability to the SSH management interface of the ASA device. No authentication or user interaction is required. An attacker sends a sequence of crafted SSH protocol messages targeting the session-establishment handler, repeating the operation until the SSH resource pool is fully consumed.

No public exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS probability at the time of writing indicates a low predicted likelihood of exploitation in the near term.

See the Cisco Security Advisory for protocol-level details:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-dos-eEDWu5RM

Detection Methods for CVE-2024-20526

Indicators of Compromise

Sudden inability to establish new SSH sessions to the ASA appliance while existing sessions and data-plane traffic remain functional.
Elevated volumes of incomplete SSH handshake attempts from a single source or small set of sources in ASA syslog output.
Unexpected growth in SSH session counters that never decrement to baseline.

Detection Strategies

Monitor ASA syslog messages related to SSH session establishment and failed handshakes, alerting on abnormal rates over short intervals.
Correlate SNMP counters tracking active and maximum SSH sessions to identify pool exhaustion trends.
Inspect network flow telemetry for bursts of TCP/22 traffic to ASA management interfaces from untrusted sources.

Monitoring Recommendations

Ingest ASA syslog and SNMP telemetry into a centralized SIEM for continuous baseline analysis.
Configure alerts when new SSH connection failure rates exceed operational baselines.
Track availability of SSH management access with active synthetic checks that flag connection refusals.

How to Mitigate CVE-2024-20526

Immediate Actions Required

Upgrade Cisco ASA Software to a fixed release as identified in the Cisco Security Advisory: ASA SSH DoS.
Restrict SSH management access to trusted management networks using interface access control lists.
Verify that ASDM or an alternate out-of-band management path remains available for recovery scenarios.

Patch Information

Cisco has published fixed software releases in the ASA SSH DoS advisory. Administrators should consult the advisory to identify the appropriate upgrade path for 9.16, 9.18, and 9.20 train deployments. No workaround fully addresses the vulnerability; only upgrading to a fixed release removes the underlying logic error.

Workarounds

Limit SSH access to specific trusted source IP addresses using the ssh command on ASA management interfaces.
Disable SSH management entirely on interfaces exposed to untrusted networks and rely on ASDM over HTTPS from restricted sources.
Monitor and manually reboot affected devices if SSH resource exhaustion is detected, restoring management access.

bash

# Example: restrict SSH access to a trusted management subnet
ciscoasa(config)# ssh 10.10.0.0 255.255.255.0 management
ciscoasa(config)# ssh timeout 5
ciscoasa(config)# no ssh 0.0.0.0 0.0.0.0 outside