CVE-2024-20481: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. The vulnerability (CVE-2024-20481) was disclosed on October 23, 2024, and affects Cisco ASA and FTD Software systems with RAVPN service enabled (Cisco Advisory).

The vulnerability is due to resource exhaustion (CWE-772) and has been assigned a CVSS base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L. The vulnerability specifically affects the RAVPN service when enabled on Cisco ASA or FTD Software systems. To determine if SSL VPN is enabled, administrators can use the 'show running-config webvpn | include ^ enable' command on the device CLI (Cisco Advisory).

A successful exploit could allow the attacker to exhaust resources, resulting in a denial of service (DoS) of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected by this vulnerability (Cisco Advisory).

The vulnerability can be exploited by an unauthenticated, remote attacker by sending a large number of VPN authentication requests to an affected device. The Cisco Product Security Incident Response Team (PSIRT) has confirmed awareness of malicious use of this vulnerability in the wild. The vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog, requiring federal agencies to apply fixes by November 14, 2024 (CISA KEV).

Cisco has released software updates that address this vulnerability. There are no workarounds available that address this vulnerability directly. However, there are mitigations outlined in the Recommendations Against Password Spray Attacks Aimed at Remote Access VPN Services in Secure Firewall TechNote. Customers should determine the applicability and effectiveness of these mitigations in their own environment (Cisco Advisory).

Cisco Talos has discussed these attacks in relation to large-scale brute-force activity targeting VPNs and SSH services with commonly used login credentials. The vulnerability has gained significant attention due to its inclusion in CISA's Known Exploited Vulnerabilities Catalog, highlighting its active exploitation in the wild (Cisco Advisory, CISA KEV).