CVE-2024-20494 A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense

What is CVE-2024-20494?

CVE-2024-20494 is a high-severity vulnerability in Cisco Adaptive Security Appliance Software, published on 23 Oct 2024.

Official description

A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper data validation during the TLS 1.3 handshake. An attacker could exploit this vulnerability by sending a crafted TLS 1.3 packet to an affected system through a TLS 1.3-enabled listening socket. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: This vulnerability can also impact the integrity of a device by causing VPN HostScan communication failures or file transfer failures when Cisco ASA Software is upgraded using Cisco Adaptive Security Device Manager (ASDM).

Weakness: CWE-1287

Which versions are affected by CVE-2024-20494?

It affects 2 products.

Products include Cisco Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense.

How do I fix CVE-2024-20494?

No fix has been published for CVE-2024-20494 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-20494 being exploited?

There is no known exploitation of CVE-2024-20494 in the wild and no public exploit code.

Other vulnerabilities in Cisco Adaptive Security Appliance Software

• CVE-2025-20333 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Exploited Critical 9.9
• CVE-2016-6366 Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Exploited High 8.8
• CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Exploited High 8.6
• CVE-2024-20353 Cisco ASA and FTD Denial of Service Exploited High 8.6
• CVE-2016-6367 Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Exploited High 7.8

All Cisco Adaptive Security Appliance Software vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rmpg-3w9x-w6pr.