CVE-2024-20499: Cisco Meraki Z4c Firmware DoS Vulnerability

CVE-2024-20499 Overview

CVE-2024-20499 is a denial of service (DoS) vulnerability in the Cisco AnyConnect VPN server running on Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices. The flaw stems from insufficient validation of client-supplied parameters during SSL VPN session establishment. An unauthenticated, remote attacker can exploit it by sending a crafted HTTPS request to the VPN server. Successful exploitation forces the AnyConnect VPN server to restart, terminating active SSL VPN sessions and requiring users to reauthenticate. A sustained attack can prevent new SSL VPN connections from being established. The service recovers gracefully once attack traffic stops.

Critical Impact
Unauthenticated remote attackers can repeatedly crash the AnyConnect VPN service, blocking remote workforce access to corporate resources without requiring credentials or user interaction.

Affected Products

Cisco Meraki MX Series (MX64, MX64W, MX65, MX65W, MX67, MX67C, MX67W, MX68, MX68CW, MX68W, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX400, MX450, MX600)
Cisco Meraki vMX virtual appliances
Cisco Meraki Z Series Teleworker Gateways (Z3, Z3C, Z4, Z4C)

Discovery Timeline

2024-10-02 - CVE-2024-20499 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20499

Vulnerability Analysis

The vulnerability resides in the Cisco AnyConnect VPN server component embedded in Meraki MX and Z Series devices. The server fails to adequately validate client-supplied parameters during the SSL VPN session negotiation phase. The associated weakness is classified as CWE-787 (Out-of-bounds Write), indicating that malformed input drives the server into an invalid memory state during connection handling.

When the server processes a crafted HTTPS request containing manipulated session parameters, the AnyConnect process restarts. All established SSL VPN tunnels drop, and clients must re-establish connections and reauthenticate. Continuous transmission of the malicious traffic produces a persistent outage of remote access services.

Root Cause

The root cause is improper input validation on parameters received from VPN clients prior to session establishment. The server trusts client-supplied data without enforcing sufficient bounds or type checks, leading to an out-of-bounds write condition that crashes the AnyConnect daemon.

Attack Vector

Exploitation requires only network access to the device's public SSL VPN endpoint on TCP port 443. The attacker does not need credentials, privileges, or user interaction. The crafted HTTPS request can be issued from any internet-connected host capable of reaching the Meraki VPN listener. Because Meraki SSL VPN is commonly internet-facing to support remote workers, the attack surface is broad.

No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.508%. See the Cisco Security Advisory for vendor technical details.

Detection Methods for CVE-2024-20499

Indicators of Compromise

Unexpected restarts of the AnyConnect VPN process on Meraki MX or Z Series devices
Mass disconnection events affecting multiple SSL VPN clients simultaneously
Repeated failed or interrupted SSL VPN session negotiations originating from a single source IP
Spikes in HTTPS traffic to the VPN endpoint immediately preceding service interruptions

Detection Strategies

Monitor the Meraki Dashboard event log for AnyConnect service restart entries and correlate with client disconnect bursts
Alert on anomalous volumes of SSL VPN handshake failures from non-corporate source IP ranges
Inspect network telemetry for crafted HTTPS requests targeting the AnyConnect VPN URL paths with malformed parameters

Monitoring Recommendations

Forward Meraki syslog and VPN session events to a centralized SIEM for correlation across the fleet
Track baseline session establishment rates per device and alert on statistical deviations
Continuously monitor uptime and availability of the AnyConnect service via synthetic VPN probes

How to Mitigate CVE-2024-20499

Immediate Actions Required

Confirm Meraki MX and Z Series devices are running firmware that includes the Cisco fix referenced in the vendor advisory
Restrict source IP ranges permitted to reach the AnyConnect VPN endpoint where business requirements allow
Enable alerting on AnyConnect service restarts and SSL VPN session failure spikes
Review the Cisco Security Advisory cisco-sa-meraki-mx-vpn-dos-QTRHzG2 for fixed firmware versions

Patch Information

Cisco has addressed the vulnerability through firmware updates distributed automatically via the Meraki cloud management platform. Administrators should verify that affected MX, vMX, and Z Series devices are on a firmware train that includes the fix. Firmware version details and upgrade scheduling are available in the Cisco Security Advisory and the Meraki Dashboard.

Workarounds

No vendor-supplied workaround fully mitigates the issue; firmware upgrade is the only complete remedy
Limit exposure by configuring source IP allowlists on upstream firewalls or cloud security gateways in front of the VPN endpoint
Where feasible, transition users to Cisco Meraki Client VPN (IPsec) until affected devices receive the patched firmware

bash

# Verify current firmware version via Meraki Dashboard API
curl -L -H "X-Cisco-Meraki-API-Key: $MERAKI_API_KEY" \
  "https://api.meraki.com/api/v1/networks/$NETWORK_ID/firmwareUpgrades"

# Restrict AnyConnect VPN access using upstream firewall ACL example
# Allow only known corporate egress ranges to reach TCP/443 on the VPN endpoint
iptables -A FORWARD -p tcp --dport 443 -s 203.0.113.0/24 -d <meraki-wan-ip> -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -d <meraki-wan-ip> -j DROP