CVE-2024-20501: Cisco Meraki MX65 Firmware DoS Vulnerability

CVE-2024-20501 Overview

CVE-2024-20501 affects the Cisco AnyConnect VPN server running on Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices. An unauthenticated, remote attacker can send crafted HTTPS requests to the VPN server and trigger a denial-of-service (DoS) condition. Successful exploitation restarts the AnyConnect VPN service, terminates established SSL VPN sessions, and forces remote users to reconnect and reauthenticate. A sustained attack prevents new SSL VPN connections from being established. The Cisco Product Security Incident Response Team (PSIRT) tracks this issue under advisory cisco-sa-meraki-mx-vpn-dos-QTRHzG2. The flaw is classified under [CWE-787] (Out-of-bounds Write).

Critical Impact
Unauthenticated remote attackers can disrupt SSL VPN availability across Cisco Meraki MX and Z Series gateways, breaking remote-worker connectivity until attack traffic stops.

Affected Products

Cisco Meraki MX series firmware (MX64, MX64W, MX65, MX65W, MX67, MX67C, MX67W, MX68, MX68CW, MX68W, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX400, MX450, MX600)
Cisco Meraki Z Series Teleworker Gateways (Z3, Z3C, Z4, Z4C)
Cisco Meraki vMX virtual appliance firmware

Discovery Timeline

2024-10-02 - CVE-2024-20501 published to NVD
2025-06-04 - Last updated in NVD database

Technical Details for CVE-2024-20501

Vulnerability Analysis

The vulnerability resides in the Cisco AnyConnect VPN server component of Cisco Meraki MX and Z Series firmware. The server fails to properly validate client-supplied parameters during SSL VPN session establishment. An attacker exploits this by transmitting a crafted HTTPS request to the VPN listener. Processing the malformed parameters triggers an out-of-bounds write condition, causing the AnyConnect VPN service to restart. The restart drops all active SSL VPN tunnels and rejects new connections during the recovery window. When the attack traffic ceases, Cisco notes the VPN server recovers gracefully without manual intervention. The impact is limited to availability — confidentiality and integrity are not affected.

Root Cause

The root cause is insufficient validation of client-supplied parameters during SSL VPN session negotiation. Mapped to [CWE-787], the flaw allows attacker-controlled data to be written outside an allocated buffer in the VPN server process. This memory corruption forces the AnyConnect service to terminate and restart, producing the DoS condition.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. The attacker needs only network reachability to the externally exposed Cisco AnyConnect VPN endpoint. A single crafted HTTPS request can disrupt one cycle of VPN service; repeated requests sustain the outage. Because Cisco Meraki MX and Z Series gateways commonly terminate remote-worker VPN traffic from the internet, the exposed attack surface is broad.

// No verified proof-of-concept code is publicly available.
// The exploit mechanism involves sending a crafted HTTPS request
// to the AnyConnect VPN endpoint with malformed session-establishment
// parameters that trigger an out-of-bounds write in the VPN server.
// See the Cisco Security Advisory for technical details.

Detection Methods for CVE-2024-20501

Indicators of Compromise

Unexpected restarts of the AnyConnect VPN service on Cisco Meraki MX or Z Series gateways
Mass disconnection of established SSL VPN sessions followed by user-driven reauthentication attempts
Repeated failed or short-lived HTTPS connections to the VPN listener from a small set of external source IPs
Spikes in VPN reconnection events in the Meraki Dashboard event log

Detection Strategies

Monitor the Meraki Dashboard for AnyConnect VPN service restart events and correlate with inbound HTTPS traffic on the VPN interface
Alert on abnormal volumes of incomplete SSL VPN handshakes targeting the WAN interface of Meraki MX and Z Series devices
Correlate VPN session termination events with simultaneous reauthentication bursts from legitimate users

Monitoring Recommendations

Forward Meraki syslog and event data to a centralized analytics platform for longitudinal availability monitoring
Track baseline AnyConnect uptime and trigger alerts on service restarts outside scheduled maintenance windows
Monitor source IPs generating malformed or repeated TLS client hellos to the VPN endpoint and apply automated blocking where appropriate

How to Mitigate CVE-2024-20501

Immediate Actions Required

Update affected Cisco Meraki MX, vMX, and Z Series devices to a firmware release that contains the fix referenced in the Cisco Security Advisory
Verify Meraki Dashboard firmware upgrade settings to confirm gateways have received the patched release
Restrict source IP ranges permitted to reach the AnyConnect VPN listener where business requirements allow

Patch Information

Cisco has released fixed firmware for affected Meraki MX, vMX, and Z Series products. Specific fixed versions and upgrade guidance are documented in the Cisco Security Advisory cisco-sa-meraki-mx-vpn-dos-QTRHzG2. Customers should confirm their devices are running a firmware version at or above the listed fixed release in the advisory.

Workarounds

Cisco has not published a workaround for this vulnerability; applying the firmware update is the recommended remediation
Where patching cannot be performed immediately, limit exposure of the AnyConnect VPN endpoint to trusted source networks using upstream access controls
Maintain a documented failover process so administrators can quickly identify and respond to repeated AnyConnect service restarts

bash

# Verify Meraki MX/Z firmware version via the Meraki Dashboard or API
# Replace ORG_ID and NETWORK_ID with environment-specific values
curl -L -H "X-Cisco-Meraki-API-Key: $MERAKI_API_KEY" \
  "https://api.meraki.com/api/v1/networks/$NETWORK_ID/firmwareUpgrades"