Cisco ASA and FTD Software Local Privilege Escalation and Persistent Remote Code Execution Vulnerability (CVE-2024-20359)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-20359) exists in a legacy capability designed for preloading VPN clients and plug-ins within Cisco ASA and FTD Software. The root cause is the improper validation of files when they are read from the system flash memory (disk0:). An attacker can exploit this by placing a crafted file into the file system, which the software subsequently loads without proper integrity verification.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first obtain administrator-level privileges on the target device. The attacker copies a malicious, specially crafted file to the disk0: file system. Upon the next system reload or reboot, the vulnerable preloading mechanism reads and executes the file. Because the injected code runs with root-level privileges and persists across reboots, it allows the attacker to maintain permanent, undetected access to the device.

3. Infrastructure & Business Impact

This vulnerability has been actively exploited in the wild by sophisticated threat actors (e.g., the ArcaneDoor campaign) targeting perimeter network devices. Successful exploitation compromises the integrity of the firewall/VPN gateway, potentially allowing attackers to intercept network traffic, perform lateral movement within the internal network, and bypass critical security controls.