Medium severity · published Oct 23, 2024
CVE-2024-20481
Cisco ASA and FTD Denial-of-Service Vulnerability
In wildKEV
5.8
CVSS
15.9%
EPSS
Yes
On KEV
Description
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service.
This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected.
Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)15.9% · higher than 97% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 24, 2024
Federal remediation dueNov 14, 2024
Ransomware campaign useNot known
Affected products
Which versions
CA
Cisco Adaptive Security Appliance (ASA) Software · Cisco
9.8.1; 9.8.1.5; 9.8.1.7; 9.8.2; 9.8.2.8; 9.8.2.14; +34 more · source: vendor
CF
Cisco Firepower Threat Defense Software · Cisco
6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; +34 more · source: vendor
AS
Adaptive Security Appliance Software · Cisco
9.8.1; 9.8.1.5; 9.8.1.7; 9.8.2; 9.8.2.8; 9.8.2.14; +34 more · source: NVD, CISA
SF
Secure Firewall Threat Defense · Cisco
6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; +34 more · source: NVD
FT
Firepower Threat Defense Software · Cisco
6.2.3; 6.2.3.10; 6.2.3.11; 6.2.3.12; 6.2.3.13; 6.2.3.14; +34 more · source: CISA
AS
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · Cisco
All versions, or not specified · source: KEV
Affected product
CA
Cisco Adaptive Security Appliance (ASA) Software
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20481
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20481
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
sec.cloudapps.cisco.com
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW
More from Cisco Adaptive Security Appliance (ASA) Software
9.1
CVE-2023-20269
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
8.6
CVE-2024-20353
Cisco ASA and FTD Denial of Service Vulnerability
7.5
CVE-2020-3452
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability
7.5
CVE-2020-3259
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability
6.1
CVE-2020-3580
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
