CVE-2024-20481KEV Β· OVERDUECWE-772

Cisco ASA and FTD Denial-of-Service Vulnerability

Medium Β· published October 23, 2024

Patch now

The score understates this β€” it's already being exploited

CVSS calls it medium at 5.8. It is confirmed in active exploitation. It sits in the 96.9th percentile for exploit probability.

709
days past CISA
deadline
CVSS v3.1
5.8
EPSS
16%
Percentile
96.9
In the wild
Confirmed
What it is

🚨 An unauthenticated attacker can flood your VPN with requests, triggering a denial of service! This vulnerability in Cisco's RAVPN service is not something to ignore. πŸ”₯ Think of it like a concert where the bouncers are overwhelmed by a crowd of ticketless fans trying to get in β€” too many requests, and the bouncers can’t manage the actual attendees. Once they’re exhausted, everyone outside is stuck, waiting for a reload of security. If exploited, this vulnerability could entirely knock out the RAVPN service, leaving legitimate users stranded and unable to access your network. In severe cases, you might need to reboot your devices to restore functionality, impacting your organization’s productivity and security.

Put simply

Think of it like a concert where the bouncers are overwhelmed by a crowd of ticketless fans trying to get in β€” too many requests, and the bouncers can’t manage the actual attendees. Once they’re exhausted, everyone outside is stuck, waiting for a reload of security. The vulnerability arises from resource exhaustion, where an attacker can send excessive VPN authentication requests to a target device, leading to a Denial of Service (DoS) condition for the RAVPN service.

What to do

If exploited, this vulnerability could entirely knock out the RAVPN service, leaving legitimate users stranded and unable to access your network. In severe cases, you might need to reboot your devices to restore functionality, impacting your organization’s productivity and security. Mitigate this risk by updating to the latest software version recommended by Cisco. Also, consider implementing rate limiting to control incoming authentication requests and monitor your systems for unusual activity related to VPN access. You've got this! Follow these steps to shore up your defenses and keep your VPN secure. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
5.8 Β· MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.15874 Β· 96.9th percentile
Weakness
CWE-772 Β· Missing Release of Resource after Effective Lifetime
Published
2024-10-23T22:15Z
KEV added
2024-10-24 Β· due 2024-11-14
Affected products (289)
ProductVersionsFixed in
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/secure_firewall_threat_defenseall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
cisco/adaptive_security_appliance_softwareall versionsβ€”
References (2)
EPSS history
Timeline
  • 24 OCT 00:00Z
    Added to CISA KEV β€” remediate by Nov 14
    kev
  • 23 OCT 17:51Z
    A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software…
    cvelistv5