CVE-2024-20481: Cisco Firepower Threat Defense DoS Flaw

CVE-2024-20481 Overview

CVE-2024-20481 is a denial of service (DoS) vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An unauthenticated, remote attacker can exhaust device resources by sending a large volume of VPN authentication requests. A successful attack disrupts the RAVPN service, and in some cases the device must be reloaded to restore functionality. Cisco Talos linked this flaw to large-scale brute-force activity targeting VPN and SSH services using commonly used login credentials. The vulnerability is tracked under [CWE-772] (Missing Release of Resource after Effective Lifetime) and is listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact

Unauthenticated attackers can disrupt Remote Access VPN services on internet-facing Cisco ASA and FTD devices, breaking remote workforce connectivity until the device is recovered or reloaded.

Affected Products

• Cisco Adaptive Security Appliance (ASA) Software — multiple versions across 9.8 through 9.20 trains
• Cisco Firepower Threat Defense (FTD) Software — multiple versions across 6.2.3 through 7.4.1 trains
• Devices with Remote Access VPN (RAVPN) service enabled

Discovery Timeline

• 2024-10-23 - CVE-2024-20481 published to NVD
• 2025-10-28 - Last updated in NVD database

Technical Details for CVE-2024-20481

Vulnerability Analysis

The flaw exists in how the RAVPN service handles incoming VPN authentication requests. When an attacker floods the device with authentication attempts, internal resources allocated to process each request are not released quickly enough to keep pace with incoming traffic. The result is a resource exhaustion condition that prevents legitimate VPN sessions from establishing. Cisco Talos research correlated exploitation with broad credential-spraying and brute-force campaigns targeting VPN and SSH endpoints. The CISA KEV listing confirms in-the-wild exploitation, and the EPSS score of 11.122% (93rd percentile) indicates elevated active exploitation likelihood relative to most CVEs.

Root Cause

The underlying weakness maps to [CWE-772], missing release of resources after their effective lifetime. The RAVPN service allocates session and authentication context per request but fails to free those resources at a rate sufficient to handle high-volume request streams. Authentication failures still consume device resources, allowing unauthenticated attackers to drive the device toward exhaustion without ever providing valid credentials.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the RAVPN listener on an internet-facing ASA or FTD interface and issues a sustained, high-volume stream of VPN authentication requests. As resource pools fill, new VPN sessions fail to establish. Services unrelated to VPN remain operational, but the impacted device may require a reload to restore RAVPN service. The same infrastructure used in observed brute-force credential campaigns can pivot to this DoS technique with minimal modification.

No verified public proof-of-concept exploit code is available. See the Cisco Security Advisory for vendor technical details.

Detection Methods for CVE-2024-20481

Indicators of Compromise

• High volume of failed VPN authentication attempts from a single source IP or distributed botnet against ASA or FTD RAVPN interfaces
• Unexpected spikes in syslog messages related to AAA authentication failures (%ASA-6-113015, %ASA-6-113005)
• Legitimate users reporting inability to establish AnyConnect or RAVPN sessions while the device remains otherwise reachable
• Sudden growth in active or half-open SSL/IPsec session counts on the ASA/FTD device

Detection Strategies

• Monitor show vpn-sessiondb and show resource usage output for abnormal session counts or resource consumption near configured limits
• Correlate authentication failure rates against historical baselines and alert on sharp deviations
• Ingest ASA/FTD syslog into a centralized SIEM and build rules for repeated authentication failures across disparate usernames from the same source

Monitoring Recommendations

• Forward RAVPN authentication logs and SNMP telemetry to a SIEM or data lake for long-term retention and correlation
• Track source IP reputation against threat intelligence feeds associated with credential-spraying infrastructure
• Alert on RAVPN service restarts, unexpected device reloads, or CPU saturation events on perimeter ASA/FTD appliances

How to Mitigate CVE-2024-20481

Immediate Actions Required

• Apply the fixed software releases identified in the Cisco Security Advisory cisco-sa-asaftd-bf-dos-vDZhLqrW
• Restrict RAVPN access to known source ranges where business requirements allow
• Enable threat-detection scanning and connection limits on RAVPN interfaces to throttle abusive sources
• Review AAA logs for prior brute-force or spraying activity and reset any potentially compromised credentials

Patch Information

Cisco has released fixed versions of ASA and FTD Software addressing CVE-2024-20481. Administrators should consult the Cisco Security Advisory to identify the appropriate fixed release for each affected train. Because the CVE is listed in the CISA Known Exploited Vulnerabilities catalog, federal agencies and other regulated organizations must remediate within mandated timelines.

Workarounds

• Configure control-plane access control lists (ACLs) to limit which source networks can reach the RAVPN service
• Implement certificate-based authentication or multi-factor authentication to reduce exposure to credential-based abuse vectors
• Use vpn-sessiondb max-anyconnect-premium-or-essentials-limit and per-tunnel-group connection limits to constrain resource consumption
• Deploy upstream rate limiting or DDoS protection in front of internet-facing ASA/FTD interfaces

# Example: restrict RAVPN access with a control-plane ACL on ASA
access-list RAVPN_ALLOW extended permit tcp <trusted-subnet> any eq 443
access-group RAVPN_ALLOW in interface outside control-plane

# Example: enable threat detection for scanning activity
threat-detection basic-threat
threat-detection scanning-threat shun