CVE-2024-20493

CVE-2024-20493 is a medium-severity vulnerability in Cisco Firepower Threat Defense Software with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-772.

Key facts

Description

A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary denial of service (DoS) condition. This vulnerability is due to ineffective handling of memory resources during the authentication process. An attacker could exploit this vulnerability by sending crafted packets, which could cause resource exhaustion of the authentication process. A successful exploit could allow the attacker to deny authentication for Remote Access SSL VPN users for several minutes, resulting in a temporary DoS condition.

Frequently asked questions

What is CVE-2024-20493?
A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary denial of service (DoS) condition. This vulnerability is due to ineffective handling of memory resources during the authentication process. An attacker could exploit this vulnerability by sending crafted packets, which could cause resource exhaustion of the authentication process. A successful exploit could allow the attacker to deny authentication for Remote Access SSL VPN users for several minutes, resulting in a temporary DoS condition.
How severe is CVE-2024-20493?
CVE-2024-20493 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2024-20493 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-20493?
CVE-2024-20493 primarily affects Cisco Firepower Threat Defense Software. In total, 294 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-20493?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-20493 have an EU (EUVD) identifier?
Yes. CVE-2024-20493 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-18208.
When was CVE-2024-20493 published?
CVE-2024-20493 was published on 2024-10-23 and last updated on 2026-06-17.

References

Affected products (294)

More vulnerabilities in Cisco Firepower Threat Defense Software

All CVEs affecting Cisco Firepower Threat Defense Software →

Other CWE-772 vulnerabilities

Browse all CWE-772 vulnerabilities →