Unauthenticated DoS Vulnerability in Cisco AnyConnect VPN Server Could Lead to Service Disruption

CVE-2024-20499

Summary

The vulnerability identified in Cisco AnyConnect VPN server affects Cisco Meraki MX and Z Series Teleworker Gateway devices, allowing unauthenticated, remote attackers to potentially trigger a Denial of Service condition. This issue stems from inadequate validation of client-supplied parameters during the establishment of an SSL VPN session. An attacker could exploit this vulnerability by sending a specially crafted HTTPS request to the affected VPN server. Successful exploitation may lead to the restart of the AnyConnect VPN server, disrupting existing SSL VPN connections and necessitating reauthentication for users. Ongoing attacks can prevent the initiation of new VPN connections while the attack is active. Fortunately, once the attack ceases, the server is capable of recovering automatically without the need for manual intervention.

References