PT-2024-18669 · Cisco · Cisco Meraki Z Series Teleworker Gateway+2
Keane Okelley
·
Published
2024-10-02
·
Updated
2024-10-08
·
CVE-2024-20501
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices (affected versions not specified)
Description
The issue is due to insufficient validation of client-supplied parameters while establishing an SSL VPN session. An attacker could exploit this by sending a crafted HTTPS request to the VPN server of an affected device, causing the Cisco AnyConnect VPN server to restart. This results in the failure of established SSL VPN connections, forcing remote users to initiate a new VPN connection and reauthenticate. A sustained attack could prevent new SSL VPN connections from being established. When the attack traffic stops, the Cisco AnyConnect VPN server recovers without requiring manual intervention.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Anyconnect Vpn Server
Cisco Meraki Mx
Cisco Meraki Z Series Teleworker Gateway