← Vulnerability feed

Vulnerability record · CVE-2024-20513 · published 2 October 2024

CVE-2024-20513: Cisco meraki mx65 firmware insecure direct object reference vulnerability

Cisco · Meraki Mx65 Firmware

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device. This vulnerability is due to insufficient entropy for handlers that are used during SSL VPN session establishment. An unauthenticated attacker could exploit this vulnerability by brute forcing valid session handlers. An authenticated attacker could exploit this vulnerability by connecting to the AnyConnect VPN service of an affected device to retrieve a valid session handler and, based on that handler, predict further valid session handlers. The attacker would then send a crafted HTTPS request using the brute-forced or predicted session handler to the AnyConnect VPN server of the device. A successful exploit could allow the attacker to terminate targeted SSL VPN sessions, forcing remote users to initiate new VPN connections and reauthenticate.

5.3 CVSS 3.1 Medium EPSS 0.45% · top 62.2% CWE-639 · Insecure direct object reference
5.3CVSS 3.1 base score
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
25Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device. This vulnerability is due to insufficient entropy for handlers that are used during SSL VPN session establishment. An unauthenticated attacker could exploit this vulnerability by brute forcing valid session handlers. An authenticated attacker could exploit this vulnerability by connecting to the AnyConnect VPN service of an affected device to retrieve a valid session handler and, based on that handler, predict further valid session handlers. The attacker would then send a crafted HTTPS request using the brute-forced or predicted session handler to the AnyConnect VPN server of the device. A successful exploit could allow the attacker to terminate targeted SSL VPN sessions, forcing remote users to initiate new VPN connections and reauthenticate.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

25 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-QTRHzG2 Vendor Advisory

Track CVE-2024-20513 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2022-20933Cisco meraki mx64 firmware vulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices could allow an unauthenticated, …EPSS 1.1%7.5CVE-2024-20501Cisco meraki mx65 firmware out-of-bounds write vulnerabilityMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un…EPSS 0.51%7.5CVE-2024-20499Cisco meraki z4c firmware out-of-bounds write vulnerabilityMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un…EPSS 0.51%7.5CVE-2024-20502Cisco meraki mx65 firmware uncontrolled resource consumption vulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentic…EPSS 0.52%7.5CVE-2024-20500Cisco meraki z4c firmware uncontrolled resource consumption vulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentic…EPSS 0.55%7.5CVE-2024-20498Cisco meraki mx65 firmware double free vulnerabilityMultiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un…EPSS 0.51%5.9CVE-2024-20509Cisco meraki mx65 firmware race condition vulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentic…EPSS 0.39%5.3CVE-2021-1224Cisco secure firewall management center vulnerabilityMultiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could …EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2024-20513), CISA KEV, FIRST EPSS (scores of 2026-10-17). This page is refreshed as NVD updates the record.