PT-2024-18671 · Cisco · Cisco Meraki Z Series Teleworker Gateway+2

Keane Okelley · Published 2024-10-02 · Updated 2025-06-03 · CVE-2024-20509

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices (affected versions not specified)

Description A vulnerability in the Cisco AnyConnect VPN server could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (DoS) condition for individual users of the AnyConnect VPN service on an affected device. This issue is due to weak entropy for handlers used during the VPN authentication process and a race condition in the same process. An attacker could exploit this by correctly guessing an authentication handler and sending crafted HTTPS requests to an affected device, potentially taking over the AnyConnect VPN session from a target user or preventing the target user from establishing a session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2024-20509

Affected Products

Cisco Anyconnect Vpn

Cisco Meraki Mx

Cisco Meraki Z Series Teleworker Gateway

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-by-QWUkqV7X · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20509 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20509 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1841581913737171059 · Twitter Post
• https://twitter.com/CVEnew/status/1841550321383850468 · Twitter Post
• https://t.me/cvedetector/6872 · Telegram Post
• https://twitter.com/SystemTek_UK/status/1929901564262556002 · Twitter Post