Attackers Are Crashing Cisco Firewalls With a New Flaw

A newly discovered zero-day flaw in Cisco firewalls is being used by attackers to remotely crash devices and disrupt network access.

Cisco has released urgent security patches for a high-severity zero-day vulnerability in its widely used firewall software. According to reporting from BleepingComputer, the flaw was being actively exploited in the wild before a fix was available. The vulnerability, tracked as CVE-2024-20353, affects Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. It allows an unauthenticated, remote attacker to force a vulnerable device to reload, triggering a denial-of-service (DoS) condition. This attack specifically targets firewalls that have the SSL VPN feature enabled, a standard configuration for providing remote workforce access. Because the attack requires no credentials or user interaction, any vulnerable, internet-facing device is at immediate risk.

Technically, the vulnerability lies within the web server component that handles SSL VPN connections on the firewalls. An attacker can send a specially crafted sequence of HTTP requests to the device's web interface, causing a memory handling error. This can lead to a memory leak or an out-of-bounds read, which destabilizes the system. When the device's software detects this critical error, it initiates a reboot as a self-preservation measure. An attacker can repeatedly trigger this reboot cycle, effectively keeping the firewall and its associated VPN services offline indefinitely. The low complexity of the exploit means that attackers can easily automate scans to find and attack vulnerable devices on a massive scale, requiring only network access to the target's web-based management interface.

This incident highlights a persistent and growing trend of attackers targeting network edge infrastructure. Devices like firewalls, VPN gateways, and load balancers are high-value targets because they are publicly accessible and serve as the gatekeepers to an organization's internal network. A successful attack can disrupt all business operations, provide a foothold for deeper network intrusion, or serve as a distraction for another attack. In recent years, similar zero-day vulnerabilities in products from Fortinet, Ivanti, and Palo Alto Networks have been rapidly exploited by both state-sponsored groups and ransomware gangs. The focus on network appliances represents a strategic shift from targeting individual endpoints to compromising the foundational infrastructure that underpins corporate IT.

For IT and security teams, the immediate priority is to apply the patches provided by Cisco. Given that the Cisco firewall zero-day is being actively exploited, delaying updates carries a significant risk of disruption. If immediate patching is not feasible, the only official workaround is to disable the SSL VPN and IKEv2 VPN features, a move that would severely impact remote access for employees. This incident serves as a critical reminder of the importance of comprehensive asset management and proactive vulnerability management. Organizations must have a clear inventory of all internet-facing devices and a rapid-response plan for patching critical flaws. In the longer term, teams should evaluate their network architecture for single points of failure and consider implementing zero-trust principles to reduce the impact of a perimeter breach.

This zero-day affects widely deployed Cisco enterprise firewalls, a core part of many companies' network infrastructure. Active exploitation means unpatched devices are at immediate risk of a denial-of-service attack that can take down remote access VPNs, disrupting operations and potentially serving as a smokescreen for other malicious activity.

An exploited flaw in common Cisco firewalls can crash the device, cutting off remote employee access and halting business operations that rely on VPN connectivity. This disruption poses a direct risk to productivity and revenue, and repeated outages can damage customer trust if external services are affected.