CVE-2024-20481

What it actually does

CVE-2024-20481 is a resource-exhaustion vulnerability in the Remote Access VPN service of Cisco ASA Software and Cisco FTD Software. An unauthenticated remote attacker can send a high volume of VPN authentication requests to an exposed RAVPN listener, consuming device or service resources until remote-access VPN becomes unavailable. In more severe cases, restoring service may require reloading the affected appliance. The impact is limited to the RAVPN service; unrelated firewall and non-VPN services are not expected to be directly affected by this flaw.

Why it matters to the business

Successful exploitation can prevent employees, administrators, contractors, and third parties from connecting through remote-access VPN, disrupting remote work, incident response, and business operations that depend on VPN connectivity. Because this vulnerability is in CISA KEV, has been observed exploited in the wild, and had a CISA remediation due date of 2024-11-14, internet-facing ASA/FTD VPN services should be treated as high-priority even though the CVSS score is moderate. The vulnerability is not known to be used directly in ransomware campaigns, but VPN outages can still create operational disruption and may coincide with credential-stuffing or brute-force activity against edge services.

How an attack unfolds

An attacker identifies an internet-exposed Cisco ASA or FTD device with Remote Access VPN enabled. They then generate a large number of VPN authentication attempts, often using automated tooling and commonly used usernames or passwords as part of broader brute-force activity against VPN and SSH services. The requests do not need to authenticate successfully; the volume of authentication traffic is sufficient to exhaust resources associated with the RAVPN service. As resources are consumed, legitimate users experience failed logins, connection timeouts, degraded VPN performance, or complete inability to establish VPN sessions. If the service does not recover automatically, administrators may need to reload the device to restore RAVPN availability.

How to fix it

Upgrade Cisco ASA Software and Cisco FTD Software to a Cisco-recommended fixed release for the affected software train as published in Cisco’s security advisory. If fixed versions are not immediately deployable, reduce exposure by disabling Remote Access VPN where it is not required, limiting VPN access to trusted source networks where feasible, enforcing upstream rate limiting or DDoS protections, and blocking clearly abusive source IPs at perimeter controls. Monitor and tune authentication infrastructure such as AAA, RADIUS, LDAP, or SAML integrations so that VPN authentication floods do not cascade into broader identity-service degradation. Review Cisco Talos guidance on large-scale brute-force activity targeting VPN services and apply hardening recommendations for VPN authentication, including MFA, lockout/rate controls that do not amplify denial-of-service conditions, and credential hygiene.

How to confirm the fix worked

Confirm the running ASA/FTD software release is at or above a Cisco fixed version for the relevant train. Verify whether Remote Access VPN is enabled and externally reachable; if it is not required, confirm it is disabled. From a controlled test source, validate that legitimate AnyConnect or RAVPN users can authenticate and establish sessions normally after patching or mitigation. Review device health during authentication testing for CPU, memory, VPN session counts, authentication queue depth, and AAA responsiveness. Confirm logging is enabled for VPN authentication events and that SIEM detections trigger on abnormal spikes in failed VPN logins, repeated authentication attempts from many sources, and RAVPN service degradation messages.

Typical attack path

1. Scan the internet or known address ranges for Cisco ASA/FTD Remote Access VPN services exposed on HTTPS/VPN listener ports.
2. Confirm the VPN endpoint responds to authentication workflows such as AnyConnect, Clientless SSL VPN, or webvpn portals.
3. Launch automated, high-volume VPN authentication attempts using many usernames, passwords, source IPs, or distributed infrastructure.
4. Sustain or repeat authentication request bursts until RAVPN resources are exhausted.
5. Cause legitimate VPN users to experience authentication failures, connection timeouts, or inability to establish new sessions.
6. Optionally continue the activity to keep the service degraded or force operational recovery actions such as a device reload.

How to detect it

To determine whether exploitation has already occurred, review Cisco ASA/FTD syslog, FMC event logs, VPN session logs, AnyConnect authentication logs, AAA/RADIUS/LDAP/SAML logs, firewall traffic logs, NetFlow, and upstream DDoS or load-balancer telemetry. Look for sudden increases in VPN authentication attempts, especially failed attempts, from many source IPs or from a small set of high-rate sources. Correlate these events with user reports of VPN timeouts, AnyConnect connection failures, RAVPN service unavailability, high CPU or memory on the appliance, AAA latency, authentication-server errors, or device reloads. Because the same activity may resemble brute-force or credential-stuffing campaigns, investigate repeated use of common usernames, default account names, sequential usernames, and geographically distributed source IPs. Check for activity around known public reporting of large-scale brute-force targeting of VPN and SSH services and around any local outage windows. This vulnerability causes denial of service rather than code execution, so evidence is more likely to appear as authentication floods, service degradation, and recovery actions than as malware files or post-exploitation artifacts.

• %ASA-6-113005
• %ASA-6-113015
• %ASA-4-113019
• AAA user authentication Rejected
• AAA failure
• Authentication failed
• Authentication rejected
• Login denied
• webvpn
• AnyConnect
• Clientless SSL VPN
• Remote Access VPN
• RAVPN
• VPN authentication
• Connection attempt failed
• Session disconnected
• Too many login attempts
• RADIUS server failed
• RADIUS server is not responding
• LDAP server failed
• SAML authentication failed
• High CPU
• Memory allocation failed
• resource exhaustion
• Device reload
• Reload requested

What your security team should do

• Treat internet-facing Cisco ASA/FTD Remote Access VPN appliances as urgent remediation targets because this vulnerability is in CISA KEV and has active exploitation in the wild.
• Inventory all Cisco ASA and FTD devices, identify those with Remote Access VPN enabled, and map them to running software versions.
• Upgrade affected devices to Cisco fixed releases as soon as operationally possible; prioritize externally reachable VPN endpoints first.
• If patching is delayed, restrict VPN exposure using upstream allow lists, geofencing where appropriate, rate limiting, DDoS protections, and temporary blocks for abusive sources.
• Monitor for large spikes in failed VPN authentication, distributed login attempts, AnyConnect/webvpn errors, and resource exhaustion symptoms on ASA/FTD devices.
• Coordinate with identity teams to monitor RADIUS, LDAP, SAML, MFA, and other authentication backends for correlated load or failures caused by VPN authentication floods.
• Prepare operational runbooks for RAVPN service degradation, including safe failover, traffic filtering, user communications, and device reload procedures if required.
• Harden VPN authentication against concurrent brute-force activity by enforcing MFA, disabling unused tunnel groups/profiles, removing stale accounts, and detecting password-spraying patterns.