CVE-2024-20299: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

A vulnerability (CVE-2024-20299) was discovered in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The vulnerability was disclosed on October 23, 2024, and affects systems running vulnerable releases of Cisco ASA or FTD Software with Forward Reference and AnyConnect Firewall Rule features enabled (Cisco Advisory).

The vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. It has been assigned a CVSS base score of 5.8 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) and is classified as CWE-290 (Authentication Bypass by Spoofing) (NVD, Cisco Advisory).

A successful exploitation of this vulnerability could allow an unauthenticated, remote attacker to bypass configured ACL rules and allow traffic that should have been denied to flow through an affected device (Cisco Advisory).

Cisco has released software updates that address this vulnerability. There are no workarounds available that address this vulnerability. Users are advised to upgrade to the latest fixed version (Cisco Advisory).