CVE-2024-20509: Cisco Meraki MX65 Auth Bypass Vulnerability

CVE-2024-20509 Overview

CVE-2024-20509 is a vulnerability in the Cisco AnyConnect VPN server component of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices. An unauthenticated, remote attacker can hijack an AnyConnect VPN session or trigger a denial of service (DoS) condition against individual VPN users. The issue combines weak entropy in authentication handlers with a race condition in the VPN authentication process. Exploitation requires correctly guessing an authentication handler value and sending crafted HTTPS requests. The flaw is tracked under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact
Successful exploitation lets an unauthenticated remote attacker take over an active AnyConnect VPN session from a legitimate user or block that user from establishing a new session.

Affected Products

Cisco Meraki MX Series (MX64, MX65, MX67, MX68, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX400, MX450, MX600) including wireless and cellular variants
Cisco Meraki Z Series Teleworker Gateways (Z3, Z3c, Z4, Z4c)
Cisco Meraki vMX virtual appliance

Discovery Timeline

2024-10-02 - CVE-2024-20509 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20509

Vulnerability Analysis

The flaw resides in the AnyConnect VPN server running on Meraki MX and Z Series gateways. During VPN authentication, the server issues per-session handlers that act as identifiers for in-flight authentication state. These handler values are generated with insufficient entropy, making them guessable by a remote attacker. A concurrent race condition in the same authentication path allows an attacker who presents a valid handler to interact with a session that belongs to another user.

By combining both weaknesses, an attacker can send crafted HTTPS requests to the VPN endpoint and either assume the victim's authenticated session or prevent the victim from completing authentication. The impact is scoped to confidentiality and availability of the VPN session rather than full device compromise, which is reflected in the vulnerability's limited impact profile. No authentication, user interaction, or network foothold is required because the AnyConnect VPN service is exposed over the internet by design.

Root Cause

The root cause is twofold: predictable authentication handler values derived from a weak entropy source, and a lack of proper synchronization in the handler lookup and session binding logic. Together these conditions permit a time-of-check to time-of-use (TOCTOU) style window where another request can be bound to the targeted user's session state.

Attack Vector

The attack vector is remote and unauthenticated over HTTPS to the AnyConnect VPN listener on an affected Meraki device. The attacker iterates handler guesses while a legitimate user is authenticating. Timing the crafted request within the race window causes the server to either reassign the authentication context to the attacker or discard the legitimate user's session. No verified public exploit or proof-of-concept is available at the time of writing.

For technical specifics, consult the Cisco Security Advisory on VPN DoS.

Detection Methods for CVE-2024-20509

Indicators of Compromise

Unexpected VPN session terminations or re-authentication prompts reported by remote users
Bursts of HTTPS requests to the AnyConnect VPN endpoint from a single external source within a short time window
VPN authentication log entries showing successful session establishment from an IP address that does not match the user's typical geolocation or ASN
Correlated failures where a legitimate user cannot complete authentication while another session for the same user is active

Detection Strategies

Baseline normal VPN authentication request rates per source IP and alert on statistical anomalies
Monitor the Meraki Dashboard event log for repeated AnyConnect authentication state transitions tied to the same user within seconds
Correlate VPN session establishment events with endpoint posture telemetry to flag sessions that do not originate from a known user device

Monitoring Recommendations

Forward Meraki syslog and VPN authentication events to a centralized SIEM or data lake for longitudinal analysis
Enable alerting on concurrent or overlapping AnyConnect sessions for the same user account
Track outbound traffic patterns from newly established VPN sessions to detect sessions that behave unlike the legitimate user's historical activity

How to Mitigate CVE-2024-20509

Immediate Actions Required

Inventory all Meraki MX, Z Series, and vMX devices and confirm firmware versions through the Meraki Dashboard
Apply the fixed firmware distributed by Cisco Meraki through the Dashboard upgrade path as soon as it is available for your release train
Restrict exposure of the AnyConnect VPN service to the smallest practical set of source networks where feasible
Enforce multi-factor authentication (MFA) on AnyConnect to raise the cost of session takeover attempts

Patch Information

Cisco Meraki distributes fixed firmware for affected MX, Z Series, and vMX devices through the Meraki Dashboard. Refer to the Cisco Security Advisory cisco-sa-meraki-mx-vpn-dos-by-QWUkqV7X for the specific fixed firmware versions and upgrade guidance for each hardware line.

Workarounds

Cisco has not published a configuration workaround that fully addresses CVE-2024-20509; patching is the authoritative remediation
As a compensating control, restrict access to the AnyConnect VPN listener using upstream network ACLs where business requirements allow
Reduce the window of exposure by shortening VPN session idle timeouts and requiring MFA on every authentication

bash

# Example compensating control: upstream ACL to restrict VPN access to known source networks
# Replace <allowed_cidr> with authorized remote user egress ranges
access-list vpn-ingress permit tcp <allowed_cidr> any eq 443
access-list vpn-ingress deny   tcp any any eq 443 log