Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-20481

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat…

Medium5.8Known exploitedEPSS 15.9%
Published
Updated
Reserved
Assigned by
cisco

Description

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Cisco ASA and FTD Denial-of-Service Vulnerability.

Added
24 Oct 2024
Fix due (US federal)
14 Nov 2024
Used by ransomware
Not known

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Scores

CVSS scores of CVE-2024-20481, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.1Medium5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
NVDNVD · Analyzed3.1Medium5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
EPSS (exploitation in 30 days)
15.9% · top 3.1% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.

Weakness

Affected products

  • Cisco · Cisco Adaptive Security Appliance (ASA) Software

    • affected 9.8.1
    • affected 9.8.1.5
    • affected 9.8.1.7
    • affected 9.8.2
    • affected 9.8.2.8
    • affected 9.8.2.14
    • affected 9.8.2.15
    • affected 9.8.2.17
    • affected 9.8.2.20
    • affected 9.8.2.24
    • affected 9.8.2.26
    • affected 9.8.2.28
    • affected 9.8.2.33
    • affected 9.8.2.35
    • affected 9.8.2.38
    • affected 9.8.3.8
    • affected 9.8.3.11
    • affected 9.8.3.14
    • affected 9.8.3.16
    • affected 9.8.3.18
    • affected 9.8.3.21
    • affected 9.8.3
    • affected 9.8.3.26
    • affected 9.8.3.29
    • affected 9.8.4
    • affected 9.8.4.3
    • affected 9.8.4.7
    • affected 9.8.4.8
    • affected 9.8.4.10
    • affected 9.8.4.12
    • affected 9.8.4.15
    • affected 9.8.4.17
    • affected 9.8.2.45
    • affected 9.8.4.25
    • affected 9.8.4.20
    • affected 9.8.4.22
    • affected 9.8.4.26
    • affected 9.8.4.29
    • affected 9.8.4.32
    • affected 9.8.4.33
    • and 159 more

  • Cisco · Cisco Firepower Threat Defense Software

    • affected 6.2.3
    • affected 6.2.3.1
    • affected 6.2.3.2
    • affected 6.2.3.3
    • affected 6.2.3.4
    • affected 6.2.3.5
    • affected 6.2.3.6
    • affected 6.2.3.7
    • affected 6.2.3.8
    • affected 6.2.3.10
    • affected 6.2.3.11
    • affected 6.2.3.9
    • affected 6.2.3.12
    • affected 6.2.3.13
    • affected 6.2.3.14
    • affected 6.2.3.15
    • affected 6.2.3.16
    • affected 6.2.3.17
    • affected 6.2.3.18
    • affected 6.6.0
    • affected 6.6.0.1
    • affected 6.6.1
    • affected 6.6.3
    • affected 6.6.4
    • affected 6.6.5
    • affected 6.6.5.1
    • affected 6.6.5.2
    • affected 6.6.7
    • affected 6.6.7.1
    • affected 6.6.7.2
    • affected 6.4.0
    • affected 6.4.0.1
    • affected 6.4.0.3
    • affected 6.4.0.2
    • affected 6.4.0.4
    • affected 6.4.0.5
    • affected 6.4.0.6
    • affected 6.4.0.7
    • affected 6.4.0.8
    • affected 6.4.0.9
    • and 50 more

What to do

Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is aware of malicious use of the vulnerability that is described in this advisory.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-20481 badge
[![CVE-2024-20481](https://trackcve.app/badge/CVE-2024-20481.svg)](https://trackcve.app/cve/CVE-2024-20481)

Record last updated .