What We Do
How We Do
Get Started
Security advisories

Two Cisco Zero-Day Vulnerabilities Exploited

April 25, 2024 | 4 MINS READ

Speak With A Security Expert Now



On April 24th, Cisco, in coordination with the Canadian Center for Cyber Security (CCCS), the Australian Cyber Security Centre (ACSC), and the National Cyber Security Centre (NCSC), disclosed two high-severity vulnerabilities in Cisco products that are under active exploitation.

The vulnerabilities are as follows:

Cisco, along with multiple government agencies, have identified exploitation of both vulnerabilities in a sophisticated, state-sponsored campaign, tracked under the name ArcaneDoor. As exploitation is confirmed, it is critical that organizations apply security patches to all impacted devices as soon as possible. 

What we’re doing about it

What you should do about it

Additional information

At this time, the initial access method used in real-world attacks has not been identified, and investigations are ongoing. According to CCCS, attacks have been confirmed against multiple governments and critical national infrastructure networks. The techniques and capabilities observed in these attacks suggest that they have been carried out by a sophisticated state-sponsored APT group. Attacks have not been attributed to a specific group at this time, and the adversary is currently tracked under the monikers UAT4356 by Talos and STORM-1849 by the Microsoft Threat Intelligence Center.

In ArcaneDoor incidents, threat actors exploited CVE-2024-20353 and CVE-2024-20359 to deliver a previously unidentified webshell dubbed LINE RUNNER and an in-memory implant dubbed LINE DANCER. The LINE RUNNER webshell establishes persistence by abusing CVE-2024-20359 and is capable of running arbitrary Lua code. LINE DANCER is a shellcode loader used to deploy additional payloads. The two threats have been used by threat actors to modify configurations, conduct reconnaissance, capture and exfiltrate network traffic, and perform lateral movement to other systems.

Access, gained via exploitation of these vulnerabilities and malware deployment, allowed threat actors to “generate text versions of the device’s configuration file so that it could be exfiltrated through web requests… control the enabling and disabling of the devices’ syslog service to obfuscate additional commands… [and] modify the authentication, authorization, and accounting (AAA) configuration so that specific actor-controlled devices, matching a particular identification, could be provided access within the impacted environment.”

Cisco reported that in July 2023 threat actors began developing and testing exploits followed by infrastructure stand up in November 2023. In early January 2024, the first confirmed attacks were reported by a victim. Additional attacks continued throughout January and February. On February 1st, eSentire’s Threat Intelligence team received information on the attacks from intelligence sharing partners and performed threat hunts based on this information. An update was sent a week later with additional information that was operationalized by our Threat Response Unit. On April 24th, alongside public disclosure of the vulnerabilities, new detections were deployed to eSentire MDR for Network; threat hunts were performed based on newly available Indicators of Compromise (IoCs).

It should be noted that Cisco addressed a third vulnerability in this release that has not been confirmed to be exploited at this time. CVE-2024-20358 (CVSS: 6.0) - Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection vulnerability. While not exploited at this time, organizations are urged to apply security patches as there is an increased focus, by both threat actors and researchers, which increases the likelihood of real-world attacks in the near future.


[2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2
[3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h  
[4] https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
[5] https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns
[6] https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-runner.pdf
[7] https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf

View Most Recent Advisories