Strix
26.1K

CVE-2024-20513

MEDIUMCVSS 5.3/10EPSS 0.46%

Last modified

CVE-2024-20513 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device. This vulnerability is due to insufficient entropy for handlers that are used during SSL VPN session establishment. An unauthenticated attacker could exploit this vulnerability by brute forcing valid session handlers. EPSS estimates a 0.46% chance of exploitation in the next 30 days.

Description

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device. This vulnerability is due to insufficient entropy for handlers that are used during SSL VPN session establishment. An unauthenticated attacker could exploit this vulnerability by brute forcing valid session handlers. An authenticated attacker could exploit this vulnerability by connecting to the AnyConnect VPN service of an affected device to retrieve a valid session handler and, based on that handler, predict further valid session handlers. The attacker would then send a crafted HTTPS request using the brute-forced or predicted session handler to the AnyConnect VPN server of the device. A successful exploit could allow the attacker to terminate targeted SSL VPN sessions, forcing remote users to initiate new VPN connections and reauthenticate.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Probability
0.46%

36.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoMeraki Mx65 Firmware>= 17.6.0, < 18.211.2
CiscoMeraki Mx64 Firmware>= 17.6.0, < 18.211.2
CiscoMeraki Z4c Firmware>= 16.2, < 18.211.2
CiscoMeraki Z4 Firmware>= 16.2, < 18.211.2
CiscoMeraki Z3c Firmware>= 16.2, < 18.211.2
CiscoMeraki Z3 Firmware>= 16.2, < 18.211.2
CiscoMeraki Vmx Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx600 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx450 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx400 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx250 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx105 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx100 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx95 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx85 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx84 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx75 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx68w Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx68cw Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx68 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx67w Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx67c Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx67 Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx65w Firmware>= 16.2, < 18.211.2
CiscoMeraki Mx64w Firmware>= 16.2, < 18.211.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2024-20513?
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device. This vulnerability is due to insufficient entropy for handlers that are used during SSL VPN session establishment. An unauthenticated attacker could exploit this vulnerability by brute forcing valid session handlers. An authenticated attacker could exploit this vulnerability by connecting to the AnyConnect VPN service of an affected device to retrieve a valid session handler and, based on that handler, predict further valid session handlers. The attacker would then send a crafted HTTPS request using the brute-forced or predicted session handler to the AnyConnect VPN server of the device. A successful exploit could allow the attacker to terminate targeted SSL VPN sessions, forcing remote users to initiate new VPN connections and reauthenticate.
How severe is CVE-2024-20513?
CVE-2024-20513 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.46% probability of exploitation in the next 30 days.
How do I fix CVE-2024-20513?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-20513?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST