CVE-2024-20260
Estado: AplazadaAlta (8.6)—
Update for September 16, 2026: The original 1.0 version of this advisory was specific to the Cisco Adaptive Security Virtual Appliance (ASAv) and Cisco Secure Firewall Threat Defense Virtual (FTDv) models. However, it was later found that this vulnerability affects all Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software platforms.
A vulnerability in the VPN and management web servers of the Cisco Secure Firewall ASA Software and Cisco Secure FTD Software platforms could allow an unauthenticated, remote attacker to cause an affected device to run out of system memory or buffer blocks, which in turn could cause SSL VPN connection processing to slow down and eventually cease altogether.
Leer descripción completaMostrar menos
This vulnerability is due to a lack of proper memory management for new incoming SSL/TLS connections. An attacker could exploit this vulnerability by sending a large number of new incoming SSL/TLS connections to the targeted device. A successful exploit could allow the attacker to deplete system memory or buffers, resulting in a denial of service (DoS) condition. The memory or buffers could be reclaimed slowly if the attack traffic is stopped, but a manual reload may be required to restore operations quickly.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Puntuación base: 8.6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.59%
- Percentil entre todas las CVEs puntuadas: 47
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access95 % - Impacto principal
T1499.004Application or System Exploitationimpact90 %
Vector CVSS AV:N/AC:L/PR:N/UI:N indica explotación remota sin autenticación (T1190). El ataque causa agotamiento de memoria/buffers en servicios de red, generando DoS por consumo de recursos (T1499.004).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (2)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-789
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-20260",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-20260",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-10-23T18:42:51.960960Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software",
"versions": [
{
"status": "affected",
"version": "9.16.1"
},
{
"status": "affected",
"version": "9.16.1.28"
},
{
"status": "affected",
"version": "9.16.2"
},
{
"status": "affected",
"version": "9.16.2.3"
},
{
"status": "affected",
"version": "9.16.2.7"
},
{
"status": "affected",
"version": "9.16.2.11"
},
{
"status": "affected",
"version": "9.16.2.13"
},
{
"status": "affected",
"version": "9.16.2.14"
},
{
"status": "affected",
"version": "9.16.3.3"
},
{
"status": "affected",
"version": "9.16.3"
},
{
"status": "affected",
"version": "9.16.3.14"
},
{
"status": "affected",
"version": "9.18.1"
},
{
"status": "affected",
"version": "9.16.3.15"
},
{
"status": "affected",
"version": "9.18.1.3"
},
{
"status": "affected",
"version": "9.18.2"
},
{
"status": "affected",
"version": "9.16.3.19"
},
{
"status": "affected",
"version": "9.16.3.23"
},
{
"status": "affected",
"version": "9.18.2.5"
},
{
"status": "affected",
"version": "9.16.4"
},
{
"status": "affected",
"version": "9.18.2.7"
},
{
"status": "affected",
"version": "9.19.1"
},
{
"status": "affected",
"version": "9.16.4.9"
},
{
"status": "affected",
"version": "9.18.2.8"
},
{
"status": "affected",
"version": "9.16.4.14"
},
{
"status": "affected",
"version": "9.18.3"
},
{
"status": "affected",
"version": "9.19.1.5"
},
{
"status": "affected",
"version": "9.16.4.18"
},
{
"status": "affected",
"version": "9.19.1.9"
},
{
"status": "affected",
"version": "9.18.3.39"
},
{
"status": "affected",
"version": "9.16.4.19"
},
{
"status": "affected",
"version": "9.19.1.12"
},
{
"status": "affected",
"version": "9.18.3.46"
},
{
"status": "affected",
"version": "9.16.4.27"
},
{
"status": "affected",
"version": "9.19.1.18"
},
{
"status": "affected",
"version": "9.18.3.53"
},
{
"status": "affected",
"version": "9.18.3.55"
},
{
"status": "affected",
"version": "9.16.4.38"
},
{
"status": "affected",
"version": "9.16.4.39"
},
{
"status": "affected",
"version": "9.18.3.56"
},
{
"status": "affected",
"version": "9.20.1"
},
{
"status": "affected",
"version": "9.16.4.42"
},
{
"status": "affected",
"version": "9.19.1.22"
},
{
"status": "affected",
"version": "9.18.4"
},
{
"status": "affected",
"version": "9.20.1.5"
},
{
"status": "affected",
"version": "9.18.4.5"
},
{
"status": "affected",
"version": "9.19.1.24"
},
{
"status": "affected",
"version": "9.16.4.48"
},
{
"status": "affected",
"version": "9.18.4.8"
},
{
"status": "affected",
"version": "9.20.2"
},
{
"status": "affected",
"version": "9.19.1.27"
},
{
"status": "affected",
"version": "9.16.4.55"
},
{
"status": "affected",
"version": "9.18.4.22"
},
{
"status": "affected",
"version": "9.20.2.10"
},
{
"status": "affected",
"version": "9.16.4.57"
},
{
"status": "affected",
"version": "9.19.1.28"
},
{
"status": "affected",
"version": "9.18.4.24"
},
{
"status": "affected",
"version": "9.20.2.21"
},
{
"status": "affected",
"version": "9.16.4.61"
},
{
"status": "affected",
"version": "9.19.1.31"
},
{
"status": "affected",
"version": "9.18.4.29"
},
{
"status": "affected",
"version": "9.20.2.22"
},
{
"status": "affected",
"version": "9.16.4.62"
},
{
"status": "affected",
"version": "9.18.4.34"
},
{
"status": "affected",
"version": "9.20.3"
},
{
"status": "affected",
"version": "9.16.4.67"
},
{
"status": "affected",
"version": "9.16.4.70"
},
{
"status": "affected",
"version": "9.18.4.40"
},
{
"status": "affected",
"version": "9.23.1"
},
{
"status": "affected",
"version": "9.22.1.1"
},
{
"status": "affected",
"version": "9.16.4.71"
},
{
"status": "affected",
"version": "9.20.3.4"
},
{
"status": "affected",
"version": "9.18.4.47"
},
{
"status": "affected",
"version": "9.20.3.7"
},
{
"status": "affected",
"version": "9.19.1.37"
},
{
"status": "affected",
"version": "9.16.4.76"
},
{
"status": "affected",
"version": "9.20.3.9"
},
{
"status": "affected",
"version": "9.19.1.38"
},
{
"status": "affected",
"version": "9.18.4.50"
},
{
"status": "affected",
"version": "9.22.1.3"
},
{
"status": "affected",
"version": "9.20.3.10"
},
{
"status": "affected",
"version": "9.22.1.2"
},
{
"status": "affected",
"version": "9.18.4.52"
},
{
"status": "affected",
"version": "9.20.3.13"
},
{
"status": "affected",
"version": "9.22.1.6"
},
{
"status": "affected",
"version": "9.18.4.53"
},
{
"status": "affected",
"version": "9.16.4.82"
},
{
"status": "affected",
"version": "9.22.2"
},
{
"status": "affected",
"version": "9.20.3.16"
},
{
"status": "affected",
"version": "9.19.1.42"
},
{
"status": "affected",
"version": "9.18.4.57"
},
{
"status": "affected",
"version": "9.16.4.84"
},
{
"status": "affected",
"version": "9.23.1.3"
},
{
"status": "affected",
"version": "9.20.3.20"
},
{
"status": "affected",
"version": "9.22.2.4"
},
{
"status": "affected",
"version": "9.23.1.7"
},
{
"status": "affected",
"version": "9.20.4"
},
{
"status": "affected",
"version": "9.22.2.9"
},
{
"status": "affected",
"version": "9.23.1.13"
},
{
"status": "affected",
"version": "9.20.4.7"
},
{
"status": "affected",
"version": "9.22.2.13"
},
{
"status": "affected",
"version": "9.18.4.66"
},
{
"status": "affected",
"version": "9.20.4.10"
},
{
"status": "affected",
"version": "9.23.1.19"
},
{
"status": "affected",
"version": "9.16.4.85"
},
{
"status": "affected",
"version": "9.22.2.14"
},
{
"status": "affected",
"version": "9.18.4.67"
},
{
"status": "affected",
"version": "9.18.4.68"
},
{
"status": "affected",
"version": "9.23.1.22"
},
{
"status": "affected",
"version": "9.20.4.14"
},
{
"status": "affected",
"version": "9.22.2.20"
},
{
"status": "affected",
"version": "9.20.4.19"
},
{
"status": "affected",
"version": "9.16.4.89"
},
{
"status": "affected",
"version": "9.16.4.92"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Cisco",
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.2.6"
},
{
"status": "affected",
"version": "7.0.6.2"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.2.7"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.2.8"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.2.8.1"
},
{
"status": "affected",
"version": "7.0.6.3"
},
{
"status": "affected",
"version": "7.4.2.1"
},
{
"status": "affected",
"version": "7.2.9"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.4.2.2"
},
{
"status": "affected",
"version": "7.2.10"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.4.2.3"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.7.11"
},
{
"status": "affected",
"version": "7.0.8.1"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.7.10.1"
},
{
"status": "affected",
"version": "7.4.2.4"
},
{
"status": "affected",
"version": "7.2.10.2"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.6.4"
},
{
"status": "affected",
"version": "7.0.9"
}
],
"defaultStatus": "unknown"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*"
],
"vendor": "cisco",
"product": "firepower_threat_defense_software",
"versions": [
{
"status": "affected",
"version": "6.2.3",
"versionType": "custom",
"lessThanOrEqual": "6.2.3.18"
},
{
"status": "affected",
"version": "7.4.1",
"versionType": "custom",
"lessThanOrEqual": "7.4.1.1"
},
{
"status": "affected",
"version": "7.3.0",
"versionType": "custom",
"lessThanOrEqual": "7.3.1.2"
},
{
"status": "affected",
"version": "7.2.0",
"versionType": "custom",
"lessThanOrEqual": "7.2.8.1"
},
{
"status": "affected",
"version": "7.1.0",
"versionType": "custom",
"lessThanOrEqual": "7.1.0.3"
},
{
"status": "affected",
"version": "7.0.0",
"versionType": "custom",
"lessThanOrEqual": "7.0.6.2"
},
{
"status": "affected",
"version": "6.7.0",
"versionType": "custom",
"lessThanOrEqual": "6.7.0.3"
},
{
"status": "affected",
"version": "6.6.0",
"versionType": "custom",
"lessThanOrEqual": "6.6.7.2"
},
{
"status": "affected",
"version": "6.4.0",
"versionType": "custom",
"lessThanOrEqual": "6.4.0.18"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*"
],
"vendor": "cisco",
"product": "adaptive_security_appliance_software",
"versions": [
{
"status": "affected",
"version": "9.8.1",
"versionType": "custom",
"lessThanOrEqual": "9.8.4.48"
},
{
"status": "affected",
"version": "9.20.2",
"versionType": "custom",
"lessThanOrEqual": "9.20.2.21"
},
{
"status": "affected",
"version": "9.19.1",
"versionType": "custom",
"lessThanOrEqual": "9.19.1.31"
},
{
"status": "affected",
"version": "9.18.1",
"versionType": "custom",
"lessThanOrEqual": "9.18.4.29"
},
{
"status": "affected",
"version": "9.17.1",
"versionType": "custom",
"lessThanOrEqual": "19.17.1.39"
},
{
"status": "affected",
"version": "9.16.1",
"versionType": "custom",
"lessThanOrEqual": "9.16.4.61"
},
{
"status": "affected",
"version": "9.15.1",
"versionType": "custom",
"lessThanOrEqual": "9.15.1.21"
},
{
"status": "affected",
"version": "9.14.1",
"versionType": "custom",
"lessThanOrEqual": "9.14.4.24"
},
{
"status": "affected",
"version": "9.12.1",
"versionType": "custom",
"lessThanOrEqual": "9.12.4.67"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-10-23T17:15:13.950",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftdvirtual-dos-MuenGnYR",
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-789"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Update for September 16, 2026: The original 1.0 version of this advisory was specific to the Cisco Adaptive Security Virtual Appliance (ASAv) and Cisco Secure Firewall Threat Defense Virtual (FTDv) models. However, it was later found that this vulnerability affects all Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software platforms.\r\n\r\nA vulnerability in the VPN and management web servers of the Cisco Secure Firewall ASA Software and Cisco Secure FTD Software platforms could allow an unauthenticated, remote attacker to cause an affected device to run out of system memory or buffer blocks, which in turn could cause SSL VPN connection processing to slow down and eventually cease altogether.\r\nThis vulnerability is due to a lack of proper memory management for new incoming SSL/TLS connections. An attacker could exploit this vulnerability by sending a large number of new incoming SSL/TLS connections to the targeted device. A successful exploit could allow the attacker to deplete system memory or buffers, resulting in a denial of service (DoS) condition. The memory or buffers could be reclaimed slowly if the attack traffic is stopped, but a manual reload may be required to restore operations quickly."
},
{
"lang": "es",
"value": "Una vulnerabilidad en los servidores web de administración y VPN de las plataformas Cisco Adaptive Security Virtual Appliance (ASAv) y Cisco Secure Firewall Threat Defense Virtual (FTDv), anteriormente Cisco Firepower Threat Defense Virtual, podría permitir que un atacante remoto no autenticado provoque que los dispositivos virtuales se queden sin memoria del sistema, lo que podría hacer que el procesamiento de la conexión SSL VPN se ralentice y, finalmente, cese por completo. Esta vulnerabilidad se debe a la falta de una administración de memoria adecuada para las nuevas conexiones SSL/TLS entrantes en las plataformas virtuales. Un atacante podría explotar esta vulnerabilidad enviando una gran cantidad de nuevas conexiones SSL/TLS entrantes a la plataforma virtual de destino. Una explotación exitosa podría permitir al atacante agotar la memoria del sistema, lo que daría como resultado una condición de denegación de servicio (DoS). La memoria podría recuperarse lentamente si se detiene el tráfico del ataque, pero puede ser necesaria una recarga manual para restaurar las operaciones rápidamente."
}
],
"lastModified": "2026-09-16T21:17:05.947",
"sourceIdentifier": "psirt@cisco.com"
}