ArcaneDoor Exploiting Cisco ASA Vulnerabilities - 20240426001¶
Overview¶
Cisco has released security updates to address ArcaneDoor—exploitation of Cisco Adaptive Security Appliances (ASA) devices and Cisco Firepower Threat Defense (FTD) software. A cyber threat actor could exploit vulnerabilities (CVE-2024-20353, CVE-2024-20359, CVE-2024-20358) to take control of an affected system.
What is vulnerable?¶
| CVE | Severity | CVSS | Product(s) Affected | Summary | Dated |
|---|---|---|---|---|---|
| CVE-2024-20353 | High | 8.6 | Check advisory's tool on vulnerable configured Cisco ASA and FTD Software | A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition | 24/04/2024 |
| CVE-2024-20359 | Medium | 6.0 | Check advisory's tool on vulnerable release of Cisco ASA Software or FTD Software | A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges | 24/04/2024 |
| CVE-2024-20358 | Medium | 6.0 | Check advisory's tool on vulnerable release of Cisco ASA Software or FTD Software | A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges | 24/04/2024 |
What has been observed?¶
There is evidence of exploitation activities and some Cisco ASA devices in Australia have been compromised.
Recommendation¶
The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of one month... (refer Patch Management):
-
Inspect logs for traces of IOCs