Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2024-20481A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat…

Description

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Cisco ASA and FTD Denial-of-Service Vulnerability.

Added
24 Oct 2024
Fix due (US federal)
14 Nov 2024
Used by ransomware
Not known

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 24 Oct 2024.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.

Timeline

  1. ID reserved

    By cisco

  2. · 12 months later

    Published

  3. · 1 day later

    Added to CISA KEV

    Known exploited in the wild

  4. · 12 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-20481, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.1Medium5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
NVDNVD · Analyzed3.1Medium5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
EPSS (exploitation in 30 days)
15.9% · top 3.1% of all CVEs (13 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.

Affected products

  • Cisco · Cisco Adaptive Security Appliance (ASA) Software

    • affected 9.8.1
    • affected 9.8.1.5
    • affected 9.8.1.7
    • affected 9.8.2
    • affected 9.8.2.8
    • affected 9.8.2.14
    • affected 9.8.2.15
    • affected 9.8.2.17
    • affected 9.8.2.20
    • affected 9.8.2.24
    • affected 9.8.2.26
    • affected 9.8.2.28
    • affected 9.8.2.33
    • affected 9.8.2.35
    • affected 9.8.2.38
    • affected 9.8.3.8
    • affected 9.8.3.11
    • affected 9.8.3.14
    • affected 9.8.3.16
    • affected 9.8.3.18
    • affected 9.8.3.21
    • affected 9.8.3
    • affected 9.8.3.26
    • affected 9.8.3.29
    • affected 9.8.4
    • affected 9.8.4.3
    • affected 9.8.4.7
    • affected 9.8.4.8
    • affected 9.8.4.10
    • affected 9.8.4.12
    • affected 9.8.4.15
    • affected 9.8.4.17
    • affected 9.8.2.45
    • affected 9.8.4.25
    • affected 9.8.4.20
    • affected 9.8.4.22
    • affected 9.8.4.26
    • affected 9.8.4.29
    • affected 9.8.4.32
    • affected 9.8.4.33
    • and 159 more

  • Cisco · Cisco Firepower Threat Defense Software

    • affected 6.2.3
    • affected 6.2.3.1
    • affected 6.2.3.2
    • affected 6.2.3.3
    • affected 6.2.3.4
    • affected 6.2.3.5
    • affected 6.2.3.6
    • affected 6.2.3.7
    • affected 6.2.3.8
    • affected 6.2.3.10
    • affected 6.2.3.11
    • affected 6.2.3.9
    • affected 6.2.3.12
    • affected 6.2.3.13
    • affected 6.2.3.14
    • affected 6.2.3.15
    • affected 6.2.3.16
    • affected 6.2.3.17
    • affected 6.2.3.18
    • affected 6.6.0
    • affected 6.6.0.1
    • affected 6.6.1
    • affected 6.6.3
    • affected 6.6.4
    • affected 6.6.5
    • affected 6.6.5.1
    • affected 6.6.5.2
    • affected 6.6.7
    • affected 6.6.7.1
    • affected 6.6.7.2
    • affected 6.4.0
    • affected 6.4.0.1
    • affected 6.4.0.3
    • affected 6.4.0.2
    • affected 6.4.0.4
    • affected 6.4.0.5
    • affected 6.4.0.6
    • affected 6.4.0.7
    • affected 6.4.0.8
    • affected 6.4.0.9
    • and 50 more

What to do

Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is aware of malicious use of the vulnerability that is described in this advisory.

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-20481 badge
[![CVE-2024-20481](https://cveledger.app/badge/CVE-2024-20481.svg)](https://cveledger.app/cve/CVE-2024-20481)

Record last updated .