← Vulnerability feed

Vulnerability record · CVE-2024-20500 · published 2 October 2024

CVE-2024-20500: Cisco meraki z4c firmware uncontrolled resource consumption vulnerability

Cisco · Meraki Z4c Firmware

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device. This vulnerability is due to insufficient resource management when establishing TLS/SSL sessions. An attacker could exploit this vulnerability by sending a series of crafted TLS/SSL messages to the VPN server of an affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to stop accepting new connections, preventing new SSL VPN connections from being established. Existing SSL VPN sessions are not impacted. Note: When the attack traffic stops, the Cisco AnyConnect VPN server recovers gracefully without requiring manual intervention.

7.5 CVSS 3.1 High EPSS 0.55% · top 55.1% CWE-400 · Uncontrolled resource consumption
7.5CVSS 3.1 base score
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
25Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an affected device. This vulnerability is due to insufficient resource management when establishing TLS/SSL sessions. An attacker could exploit this vulnerability by sending a series of crafted TLS/SSL messages to the VPN server of an affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to stop accepting new connections, preventing new SSL VPN connections from being established. Existing SSL VPN sessions are not impacted. Note: When the attack traffic stops, the Cisco AnyConnect VPN server recovers gracefully without requiring manual intervention.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

25 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-QTRHzG2 Vendor Advisory

Track CVE-2024-20500 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2022-20933Cisco meraki mx64 firmware vulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices could allow an unauthenticated, …EPSS 1.1%7.5CVE-2024-20502Cisco meraki mx65 firmware uncontrolled resource consumption vulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentic…EPSS 0.52%7.5CVE-2024-20499Cisco meraki z4c firmware out-of-bounds write vulnerabilityMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un…EPSS 0.51%7.5CVE-2024-20501Cisco meraki mx65 firmware out-of-bounds write vulnerabilityMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un…EPSS 0.51%7.5CVE-2024-20498Cisco meraki mx65 firmware double free vulnerabilityMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un…EPSS 0.51%5.9CVE-2024-20509Cisco meraki mx65 firmware race condition vulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentic…EPSS 0.39%5.3CVE-2024-20513Cisco meraki mx65 firmware insecure direct object reference vulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentic…EPSS 0.45%5.3CVE-2021-1224Cisco secure firewall management center vulnerabilityMultiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could …EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2024-20500), CISA KEV, FIRST EPSS (scores of 2026-10-14). This page is refreshed as NVD updates the record.