Cisco ASA/FTD Persistent Local Code Execution (CVE-2024-20359)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505545);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/20");

  script_cve_id("CVE-2024-20359");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/05/01");

  script_name(english:"Cisco ASA/FTD Persistent Local Code Execution (CVE-2024-20359)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in a legacy capability that allowed for the
preloading of VPN clients and plugins and that has been available in
Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower
Threat Defense (FTD) Software could allow an authenticated, local
attacker to execute arbitrary code with root-level privileges.
Administrator-level privileges are required to exploit this
vulnerability. This vulnerability is due to improper validation of a
file when it is read from system flash memory. An attacker could
exploit this vulnerability by copying a crafted file to the disk0:
file system of an affected device. A successful exploit could allow
the attacker to execute arbitrary code on the affected device after
the next reload of the device, which could alter system behavior. This
vulnerability affects the confidentiality, integrity, and availability
of the affected device. Note: This vulnerability was publicly
disclosed in conjunction with the ArcaneDoor state-sponsored espionage
campaign that targeted perimeter network devices.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f8c3e04b");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-20359");

  script_cwe_id(94);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/04/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:firepower_threat_defense");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.12_branch" :
        {"versionStartIncluding" : "9.12.1", "versionEndIncluding" : "9.12.4.65", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.14_branch" :
        {"versionStartIncluding" : "9.14.1", "versionEndExcluding" : "9.14.4.23", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16_branch" :
        {"versionStartIncluding" : "9.16.1", "versionEndIncluding" : "9.16.4.55", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17_branch" :
        {"versionStartIncluding" : "9.17.1", "versionEndIncluding" : "9.17.1.33", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18_branch" :
        {"versionStartIncluding" : "9.18.1", "versionEndIncluding" : "9.18.4.8", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.19_branch" :
        {"versionStartIncluding" : "9.19.1", "versionEndIncluding" : "9.19.1.27", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.20_branch" :
        {"versionStartIncluding" : "9.20.1", "versionEndIncluding" : "9.20.2", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:firepower_threat_defense:6.2.3_branch" :
        {"versionStartIncluding" : "6.2.3", "versionEndIncluding" : "6.2.3.18", "family" : "CiscoFirepower", "os" : "FTD"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);