Strix
26.1K

CVE-2024-20509

MEDIUMCVSS 5.9/10EPSS 0.37%

Last modified

CVE-2024-20509 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (DoS) condition for individual users of the AnyConnect VPN service on an affected device. This vulnerability is due to weak entropy for handlers that are used during the VPN authentication process as well as a race condition that exists in the same process. An attacker could exploit this vulnerability by correctly guessing an authentication handler and then sending crafted HTTPS requests to an affected device. EPSS estimates a 0.37% chance of exploitation in the next 30 days.

Description

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (DoS) condition for individual users of the AnyConnect VPN service on an affected device. This vulnerability is due to weak entropy for handlers that are used during the VPN authentication process as well as a race condition that exists in the same process. An attacker could exploit this vulnerability by correctly guessing an authentication handler and then sending crafted HTTPS requests to an affected device. A successful exploit could allow the attacker to take over the AnyConnect VPN session from a target user or prevent the target user from establishing an AnyConnect VPN session with the affected device.

Metrics

CVSS 3.1
5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
0.37%

28.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoMeraki Mx65 Firmware>= 17.6.0, < 18.211.2
CiscoMeraki Mx64 Firmware>= 17.6.0, < 18.211.2
CiscoMeraki Z4c Firmware>= 16.2, < 18.211.2
CiscoMeraki Z4 Firmware>= 16.2, < 18.211.2
CiscoMeraki Z3c Firmware>= 16.2, < 18.211.2
CiscoMeraki Z3 Firmware>= 16.2, < 18.211.2
CiscoMeraki Vmx Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx600 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx450 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx400 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx250 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx105 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx100 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx95 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx85 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx84 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx75 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx68w Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx68cw Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx68 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx67w Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx67c Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx67 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx65w Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx64w Firmware>= 16.2, < 18.211.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2024-20509?
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (DoS) condition for individual users of the AnyConnect VPN service on an affected device. This vulnerability is due to weak entropy for handlers that are used during the VPN authentication process as well as a race condition that exists in the same process. An attacker could exploit this vulnerability by correctly guessing an authentication handler and then sending crafted HTTPS requests to an affected device. A successful exploit could allow the attacker to take over the AnyConnect VPN session from a target user or prevent the target user from establishing an AnyConnect VPN session with the affected device.
How severe is CVE-2024-20509?
CVE-2024-20509 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 0.37% probability of exploitation in the next 30 days.
How do I fix CVE-2024-20509?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-20509?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST