Denial of Service Vulnerability in Cisco AnyConnect VPN on Cisco Meraki Devices

CVE-2025-20271

What is CVE-2025-20271?

A vulnerability in the Cisco AnyConnect VPN server, found on Cisco Meraki MX and Z Series Teleworker Gateway devices, allows unauthenticated remote attackers to disrupt service. This is due to variable initialization issues that occur when establishing an SSL VPN session. By sending specially crafted HTTPS requests, an attacker can trigger a restart of the Cisco AnyConnect service, resulting in a denial of service for all current and new VPN users. A successful exploit not only forces existing connections to drop but can also hinder new connections from being formed, rendering the VPN service inaccessible to legitimate users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References