Cisco ASA/Firepower Threat Defense Software Remote Access VPN denial of service

Summaryinfo

A vulnerability was found in Cisco ASA and Firepower Threat Defense Software and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Remote Access VPN. Such manipulation leads to denial of service. This vulnerability is referenced as CVE-2024-20481. It is possible to launch the attack remotely. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco ASA and Firepower Threat Defense Software (the affected version is unknown). It has been rated as problematic. Affected by this issue is an unknown code of the component Remote Access VPN. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2024-20481 since 11/08/2023. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but an exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/28/2025). The MITRE ATT&CK project declares the attack technique as T1499.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 209988 (Cisco Firepower Threat Defense Software Remote Access VPN Brute Force DoS (cisco-sa-asaftd-bf-dos-vDZhLqrW)), which helps to determine the existence of the flaw in a target environment. This issue was added on 10/24/2024 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 11/14/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (926) and Tenable (209988). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• ASA
• Firepower Threat Defense Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion