Secure Firewall ASA and FTD
CVE-2024-20407: A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Ci…
A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies on an affected system.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityMEDIUMCVSS 3.1 5.8
EPSS0.40%Chance of exploitation in 30 days
Public exploitNot tracked
FixNot yet
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.2 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.6 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.4 | See the advisory |
| Cisco Firepower Threat Defense Software 6.7 | See the advisory |
| Cisco Firepower Threat Defense Software 6.7 | See the advisory |
| Cisco Firepower Threat Defense Software 6.7 | See the advisory |
| Cisco Firepower Threat Defense Software 6.7 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.0 | See the advisory |
| Cisco Firepower Threat Defense Software 7.1 | See the advisory |
| Cisco Firepower Threat Defense Software 7.1 | See the advisory |
| Cisco Firepower Threat Defense Software 7.1 | See the advisory |
| Cisco Firepower Threat Defense Software 7.1 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.2 | See the advisory |
| Cisco Firepower Threat Defense Software 7.3 | See the advisory |
| Cisco Firepower Threat Defense Software 7.3 | See the advisory |
| Cisco Firepower Threat Defense Software 7.3 | See the advisory |
| Cisco Firepower Threat Defense Software 7.3 | See the advisory |
| Cisco Firepower Threat Defense Software 7.4 | See the advisory |
| Cisco Firepower Threat Defense Software 7.4 | See the advisory |
| Cisco Firepower Threat Defense Software 7.4 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies on an affected system. Devices that are configured with Snort 2 are not affected by this vulnerability. This vulnerability is due to a logic error when handling embryonic (half-open) TCP connections. An attacker could exploit this vulnerability by sending a crafted traffic pattern through an affected device. A successful exploit could allow unintended traffic to enter the network protected by the affected device.
Exploitation
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.