CVE-2024-20481: Cisco ASA and FTD Denial-of-Service Vulnerability

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-10-24
EPSS: 15.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-23 · updated 2026-08-11
Weakness: CWE-772

Description

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.

Summary

CVE-2024-20481 is a resource-exhaustion flaw in the Remote Access VPN (RAVPN) service of Cisco ASA and FTD Software that lets an unauthenticated, remote attacker send many VPN authentication requests to cause a denial of service; a device reload may be needed to restore RAVPN, though non-VPN services are unaffected. It affects Cisco ASA Software and Cisco Firepower Threat Defense Software. Exploitation is active and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog, with about 15.9% EPSS probability of exploitation in 30 days. Apply mitigations per vendor instructions or discontinue use if none are available.

CVE-2024-20481 ثغرة استنزاف موارد في خدمة Remote Access VPN (RAVPN) في برمجيات Cisco ASA وFTD، تتيح لمهاجم بعيد غير مصادَق إرسال عدد كبير من طلبات مصادقة VPN لإحداث حجب خدمة (DoS) لخدمة RAVPN، وقد يلزم إعادة تحميل الجهاز لاستعادتها، مع عدم تأثر الخدمات غير المتعلقة بـ VPN. تؤثر الثغرة في Cisco ASA Software وCisco Firepower Threat Defense Software. الاستغلال نشط والثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال، مع احتمال استغلال نحو 15.9% خلال 30 يوماً وفق EPSS. طبّق التخفيفات وفق تعليمات المورّد أو أوقف استخدام المنتج إن لم تتوفر التخفيفات.

Affected products

Cisco ASA Software: 9.8.1, 9.8.1.5, 9.8.1.7, 9.8.2, 9.8.2.8, 9.8.2.14 (+193)
Cisco Firepower Threat Defense Software: 6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5 (+84)

References

Get alerted when CVE-2024-20481 or the next vulnerability affects your stack