CVE-2024-20407

MEDIUM

Published Oct 23, 2024 Modified Aug 5, 2025 CWE-399

Description

A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies on an affected system. Devices that are configured with Snort 2 are not affected by this vulnerability. This vulnerability is due to a logic error when handling embryonic (half-open) TCP connections. An attacker could exploit this vulnerability by sending a crafted traffic pattern through an affected device. A successful exploit could allow unintended traffic to enter the network protected by the affected device.

Is your site exposed to CVE-2024-20407?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness Type (CWE)

CWE-399 CWE-399

Affected Products

Vendor	Product	Versions
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All
cisco	firepower_threat_defense	All

References

Advisories & Patches

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-bypass-PTry37fX

Frequently Asked Questions

What is CVE-2024-20407? +

How severe is CVE-2024-20407? +

CVE-2024-20407 has a CVSS v3.1 score of 5.8 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-20407? +

CVE-2024-20407 affects products from cisco, specifically: firepower_threat_defense. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-20407? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-20467 8.6

A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, …

CVE-2022-43855 6.2

IBM SPSS Statistics 26.0, 27.0.1, and 28.0 IO Module could allow a local user to create multiple files that could …

CVE-2023-29267 5.3

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5is vulnerable to a denial of …

CVE-2024-58113 5.3

Vulnerability of improper resource management in the memory management module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2026-41983 4.3

DoS vulnerability in the browser kernel. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-20188 10.0

A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles …