CVE-2024-20481
Cisco Adaptive Security Appliance Software 9.12.1 … 9.8.4.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20481 is a medium-severity Missing Release of Resource after Effective Lifetime (CWE-772) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 5.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in the Remote Access VPN service of Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software allows resource exhaustion that results in denial of service. The flaw, tracked as CVE-2024-20481 and assigned CWE-772, is triggered when an affected device receives a large volume of VPN authentication requests, exhausting resources dedicated to the RAVPN service while leaving unrelated services intact. A device reload may be necessary to restore functionality.
An unauthenticated remote attacker can exploit the issue by sending repeated authentication requests against exposed RAVPN endpoints. Successful exploitation produces a denial-of-service condition limited to the VPN service; the CVSS 5.8 score reflects a network-attack vector with low complexity and no required privileges or user interaction.
The Cisco Security Advisory and CISA Known Exploited Vulnerabilities catalog both list the CVE, confirming that mitigation steps and software updates are available through Cisco. Cisco Talos has separately documented large-scale brute-force campaigns targeting VPN services with common credentials, consistent with the attack pattern described for this vulnerability. The EPSS score reached a peak of 0.1267 and currently stands at 0.1112.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18196
Vulnerability Data
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service.…
more
This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.
- CWE(s)
- KEV Date Added
- 24 October 2024
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing resource releases through dynamic analysis or stress testing.
Requiring documented development standards and tools can mandate explicit resource-release patterns in code.
Resource-quota allocation limits the blast radius of an unreleased-resource exhaustion condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Runtime monitoring may surface resource-exhaustion symptoms but does not address release logic.
Lifecycle management explicitly requires handling resources through end-of-life including release.
Capacity monitoring can detect exhaustion caused by unreleased resources but does not prevent the root defect.
Secure SDLC practices directly prevent missing resource-release defects during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit information-deletion requirements directly address timely release of resources after use.