Denial of Service Vulnerability in Cisco AnyConnect on Meraki Devices

CVE-2025-20212

Summary

A vulnerability in the Cisco AnyConnect VPN server on Cisco Meraki MX and Z Series devices allows an authenticated remote attacker to trigger a denial of service (DoS) condition. The vulnerability is rooted in an uninitialized variable during SSL VPN session establishment. An attacker with valid VPN credentials can exploit this flaw by sending specially crafted attributes, causing the AnyConnect VPN server to restart. This interruption leads to the failure of existing SSL VPN sessions, necessitating reauthentication for remote users. A sustained attack could prevent new connections entirely, though the server will recover automatically once the attack ceases.

References