onyx --cves cve-2024-20359
CVE-2024-20359
- score
- <0.1
- cvss
- 6.0
- epss
- 19.4%
- published
- 2024-04-24
- kev added
- 2024-04-24
- first seen
Cisco ASA and FTD Software contain a vulnerability caused by improper validation of files read from system flash memory, letting authenticated, local attackers with administrator privileges execute arbitrary code after device reload, exploit requires copying a crafted file to disk0:.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Added to CISA KEV
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 13
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h
- https://nvd.nist.gov/vuln/detail/CVE-2024-20359
- https://www.tenable.com/blog/verizon-2025-dbir-tenable-research-collaboration
- https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf
- https://cert.europa.eu/publications/threat-intelligence/cb25-12/
- https://www.enisa.europa.eu/sites/default/files/2025-11/ENISA%20Public%20Administration%20TL%202024_0.pdf
- https://www.zscaler.com/blogs/security-research/cisco-firewall-and-vpn-zero-day-attacks-cve-2025-20333-and-cve-2025-20362
- https://www.verizon.com/business/resources/T32e/reports/2025-dbir-data-breach-investigations-report.pdf
- https://insights.nccgroup.com/l/898251/2025-01-24/31knsst/898251/1737713506BZGVGklo/TI_Annual_Report_24_digital.pdf
- https://labs.withsecure.com/publications/mass-exploitation-the-vulnerable-edge-of-enterprise-security
- https://censys.com/analysis-of-arcanedoor-threat-infrastructure-suggests-potential-ties-to-chinese-based-actor/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20359
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/