CVE-2024-20500: Cisco Meraki Z4c Firmware DoS Vulnerability

CVE-2024-20500 Overview

CVE-2024-20500 is a denial-of-service (DoS) vulnerability in the Cisco AnyConnect VPN server component of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices. The flaw stems from insufficient resource management when establishing TLS/SSL sessions [CWE-400]. An unauthenticated, remote attacker can send a series of crafted TLS/SSL messages to the VPN server and cause it to stop accepting new connections. Existing SSL VPN sessions continue uninterrupted, and the service recovers gracefully once the attack traffic stops. The vulnerability affects a broad range of Meraki MX security appliances and Z Series teleworker gateways used for remote access at the network edge.

Critical Impact
A remote, unauthenticated attacker can disrupt SSL VPN availability on Cisco Meraki MX and Z Series gateways, preventing remote workers and branch users from establishing new AnyConnect sessions until the attack traffic ceases.

Affected Products

Cisco Meraki MX series appliances (MX64, MX64W, MX65, MX65W, MX67, MX67C, MX67W, MX68, MX68CW, MX68W, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX400, MX450, MX600)
Cisco Meraki vMX virtual appliances
Cisco Meraki Z Series Teleworker Gateways (Z3, Z3C, Z4, Z4C)

Discovery Timeline

2024-10-02 - CVE-2024-20500 published to NVD
2025-06-04 - Last updated in NVD database

Technical Details for CVE-2024-20500

Vulnerability Analysis

The vulnerability resides in the Cisco AnyConnect VPN server implementation that handles SSL VPN connections on Meraki MX and Z Series devices. When clients initiate AnyConnect sessions, the server negotiates TLS/SSL sessions to encrypt traffic between the remote client and the gateway. The server fails to properly manage the resources allocated to these TLS/SSL handshake operations. An attacker who repeatedly initiates crafted TLS/SSL messages can exhaust the server's session-handling capacity. Once exhausted, the VPN server refuses new connection attempts, denying remote access to legitimate users. Established SSL VPN sessions remain functional during the attack, and the AnyConnect service automatically resumes accepting connections after the malicious traffic stops, without manual intervention from administrators.

Root Cause

The root cause is improper resource management [CWE-400] within the TLS/SSL session establishment path of the AnyConnect VPN server. The service does not enforce sufficient limits or cleanup logic for partially completed handshake state, allowing crafted message sequences to consume connection resources faster than they are released.

Attack Vector

Exploitation requires only network reachability to the AnyConnect VPN listener on an affected Meraki device. No authentication or user interaction is required. An attacker sends a series of crafted TLS/SSL messages targeting the VPN endpoint. Because Meraki MX and Z Series appliances are typically internet-facing to support remote workers, the AnyConnect service is commonly exposed to untrusted networks, making this vulnerability reachable from the public internet.

No verified public exploit code is currently available for CVE-2024-20500. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Cisco Security Advisory for additional technical detail.

Detection Methods for CVE-2024-20500

Indicators of Compromise

Sudden inability of remote users to establish new AnyConnect SSL VPN sessions while existing sessions remain active.
Spikes in inbound TLS/SSL handshake traffic to the AnyConnect VPN listener on Meraki MX or Z Series devices.
High volumes of incomplete or abandoned TLS handshakes from a small set of source IPs targeting the VPN endpoint.
VPN service self-recovery after external traffic subsides, with no operator-initiated restart.

Detection Strategies

Monitor Cisco Meraki dashboard event logs and VPN client connection metrics for sustained failures of new SSL VPN connections.
Correlate network telemetry for repeated TLS ClientHello floods or malformed handshake sequences directed at AnyConnect VPN ports.
Baseline normal AnyConnect connection rates per source IP and alert on deviations consistent with handshake-based resource exhaustion.

Monitoring Recommendations

Forward Meraki event logs and firewall flow data into a centralized SIEM or data lake for cross-source correlation and historical analysis.
Set alerting thresholds for VPN connection establishment failure rates and surface anomalies to on-call responders.
Track upstream perimeter telemetry (NetFlow, IPS) for connection patterns indicative of TLS handshake abuse against VPN concentrators.

How to Mitigate CVE-2024-20500

Immediate Actions Required

Apply the fixed Cisco Meraki firmware versions identified in the Cisco Security Advisory cisco-sa-meraki-mx-vpn-dos-QTRHzG2. Most Meraki devices receive firmware automatically through the Meraki cloud.
Verify firmware versions across all MX and Z Series devices in the Meraki dashboard and schedule upgrades for any device still running vulnerable firmware.
Review AnyConnect VPN exposure and restrict source addresses where operationally feasible.

Patch Information

Cisco has released fixed firmware for affected Meraki MX and Z Series devices. Customers should consult the Cisco Security Advisory for the specific fixed firmware trains applicable to each model. Because the Meraki platform manages firmware centrally, administrators should confirm device firmware status and force upgrades through the dashboard if required.

Workarounds

Cisco has not published a documented workaround for this vulnerability; upgrading firmware is the supported remediation.
Where firmware upgrade is delayed, consider restricting AnyConnect VPN reachability to known client IP ranges using upstream access control lists.
Maintain redundant remote access paths (such as secondary VPN gateways) to preserve availability if a single gateway is targeted.

bash

# Configuration example: verify Meraki MX firmware via the Meraki Dashboard API
curl -L -H "X-Cisco-Meraki-API-Key: $MERAKI_API_KEY" \
  "https://api.meraki.com/api/v1/networks/{networkId}/firmwareUpgrades"