Cisco has released critical security updates to address multiple vulnerabilities in its Adaptive Security Appliance (ASA) devices and Firepower Threat Defense (FTD) software, collectively known as the “ArcaneDoor” vulnerabilities.

If exploited, these vulnerabilities could allow a cyber threat actor to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.

Recently, GBHackers on Security reported that a sophisticated cyber espionage campaign dubbed “ArcaneDoor” conducted by a state-sponsored threat actor tracked as UAT4356 to exploit these 2 zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco’s Adaptive Security Appliance (ASA) firewalls.

Combat Email Threats with Free Phishing Simulations: Email Security Awareness Training ->Try Free Demo 

CVE-2024-20353 and CVE-2024-20359: Persistent Remote Code Execution Vulnerabilities

These two vulnerabilities tracked as CVE-2024-20353 and CVE-2024-20359, are persistent remote code execution vulnerabilities in Cisco ASA and FTD software.

They allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system with root-level privileges.

The vulnerabilities exist due to improper handling of certain HTTP requests and improper sanitization of user-supplied data.

An attacker could exploit these vulnerabilities by sending crafted HTTP requests to a targeted device, potentially leading to complete system compromise.

“To determine whether a device that is running Cisco ASA Software or FTD Software is affected, use the show asp table socket | include SSL command and look for an SSL listen socket on any TCP port.”

If a socket is present in the output, the device should be considered vulnerable. The following example shows the output for a Cisco ASA device with two SSL listen sockets on TCP port 443 and TCP port 8443:

ciscoasa#  show asp table socket | include SSL
SSL       00185038  LISTEN     172.16.0.250:443    0.0.0.0:*
SSL       00188638  LISTEN      10.0.0.250:8443    0.0.0.0:*   

Cisco has confirmed active exploitation of these vulnerabilities and has released software updates to address them. No workarounds are available, and users are strongly encouraged to apply the necessary updates immediately.

CVE-2024-20358: Web Services Denial of Service Vulnerability

CVE-2024-20358 is a denial of service (DoS) vulnerability in the management and VPN web servers of Cisco ASA and FTD software.

An unauthenticated, remote attacker could cause the affected device to reload unexpectedly, resulting in a DoS condition.

The vulnerability is due to incomplete error checking when parsing an HTTP header.

An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on the device, causing it to reload and become unavailable.

This vulnerability affects the Cisco ASA restore CLI command that is described in the Software and Configurations chapter of the Cisco ASA Series General Operations CLI Configuration Guide.

This vulnerability does not affect the backup restore functionalities documented in the System Management chapter of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager and the Backup and Restore chapter of the Firepower Management Center Configuration Guide.

Cisco has released software updates to address this vulnerability, and there are no workarounds available.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide