Cisco AnyConnect VPN Server vulns could lead to DoS attacks

CVE-2024-20498

Summary

Multiple vulnerabilities exist within the Cisco AnyConnect VPN server utilized by Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices. These vulnerabilities are primarily linked to inadequate validation of client-supplied parameters during the initiation of SSL VPN sessions. An attacker could craft a malicious HTTPS request targeting the VPN server of an affected device, potentially leading to a denial of service condition. This exploitation could force the Cisco AnyConnect VPN server to restart, disrupting established SSL VPN connections and necessitating remote users to reauthenticate. Although the server can recover automatically upon the cessation of attack traffic, continuous exploitation may hinder new SSL VPN connections from being established.

References