CVE-2024-20481
Cisco Adaptive Security Appliance Software 9.12.1 … 9.8.4.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LSummary
CVE-2024-20481 is a medium-severity Missing Release of Resource after Effective Lifetime (CWE-772) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 5.8 (Medium).
Operationally, ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to AC-7 (Unsuccessful Logon Attempts) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in the Remote Access VPN service of Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software allows resource exhaustion that results in denial of service. The flaw, tracked as CVE-2024-20481 and assigned CWE-772, is triggered when an affected device receives a large volume of VPN authentication requests, exhausting resources dedicated to the RAVPN service while leaving unrelated services intact. A device reload may be necessary to restore functionality.
An unauthenticated remote attacker can exploit the issue by sending repeated authentication requests against exposed RAVPN endpoints. Successful exploitation produces a denial-of-service condition limited to the VPN service; the CVSS 5.8 score reflects a network-attack vector with low complexity and no required privileges or user interaction.
The Cisco Security Advisory and CISA Known Exploited Vulnerabilities catalog both list the CVE, confirming that mitigation steps and software updates are available through Cisco. Cisco Talos has separately documented large-scale brute-force campaigns targeting VPN services with common credentials, consistent with the attack pattern described for this vulnerability. The EPSS score reached a peak of 0.1267 and currently stands at 0.1112.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18196
Vulnerability Data
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service.…
more
This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.
- CWE(s)
- KEV Date Added
- 24 October 2024
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires denial-of-service protections that limit the impact of resource-exhaustion attacks against network-accessible services such as RAVPN.
Enforces limits on consecutive unsuccessful VPN authentication attempts, directly reducing the volume of requests an unauthenticated attacker can send to exhaust resources.
Restricts the number of concurrent remote-access sessions, limiting the resources an attacker can consume through repeated authentication requests against the RAVPN service.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Lifecycle management explicitly requires handling resources through end-of-life including release.
Secure SDLC practices directly prevent missing resource-release defects during development.
Runtime monitoring may surface resource-exhaustion symptoms but does not address release logic.
Capacity monitoring can detect exhaustion caused by unreleased resources but does not prevent the root defect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit information-deletion requirements directly address timely release of resources after use.
Secure-SDLC practices include resource-management reviews, yet the control covers the entire lifecycle, not just this weakness.
Secure-coding rules can mandate explicit resource-release patterns, but the control is broader than this single weakness.
Change-management processes may catch missing de-allocation during reviews, but the control itself does not target resource lifetime.
Configuration baselines can enforce resource limits or timeouts, indirectly reducing exposure to leaks.