WaratekVRT Sign in

CVE-2024-20481

Severity5.8 Medium CVSS 3.1 2 scores
WeaknessCWE-772
Published23 Oct 2024
Updated11 Aug 2026

Description

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2024-10-24 · remediation due 2024-11-14 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 3 citations · earliest 2024-10-23.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
  • Indexed PoC none indexed
  • EPSS 16% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2024-20481 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation sec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW 2024-10-23
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2024-10-24
Reported exploitation eclypsium.com /blog/cisco-asa-scanning-surge-cyberattack 2025-09-16

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (cisco/secure_firewall_threat_defense). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

5.8 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 5.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L psirt@cisco.com Secondary published
CVSS 3.1 5.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L NVD Primary

Affected software and releases

Products and versions

2 products, 289 version entries
SourceVendorProductSchemeAffected versions
nvd cisco adaptive security appliance software generic 9.8.1 · 9.8.1.5 · 9.8.1.7 · 9.8.2 · 9.8.2.8 · 9.8.2.14 · 9.8.2.15 · 9.8.2.17 · 9.8.2.20 · 9.8.2.24 · 9.8.2.26 · 9.8.2.28 · 9.8.2.33 · 9.8.2.35 · 9.8.2.38 · 9.8.2.45 · 9.8.3 · 9.8.3.8 · 9.8.3.11 · 9.8.3.14 · 9.8.3.16 · 9.8.3.18 · 9.8.3.21 · 9.8.3.26 · 9.8.3.29 · 9.8.4 · 9.8.4.3 · 9.8.4.7 · 9.8.4.8 · 9.8.4.10 · 9.8.4.12 · 9.8.4.15 · 9.8.4.17 · 9.8.4.20 · 9.8.4.22 · 9.8.4.25 · 9.8.4.26 · 9.8.4.29 · 9.8.4.32 · 9.8.4.33 · 9.8.4.34 · 9.8.4.35 · 9.8.4.39 · 9.8.4.40 · 9.8.4.41 · 9.8.4.43 · 9.8.4.44 · 9.8.4.45 · 9.8.4.46 · 9.8.4.48 · 9.12.1 · 9.12.1.2 · 9.12.1.3 · 9.12.2 · 9.12.2.1 · 9.12.2.4 · 9.12.2.5 · 9.12.2.9 · 9.12.3 · 9.12.3.2 · 9.12.3.7 · 9.12.3.9 · 9.12.3.12 · 9.12.4 · 9.12.4.2 · 9.12.4.4 · 9.12.4.7 · 9.12.4.8 · 9.12.4.10 · 9.12.4.13 · 9.12.4.18 · 9.12.4.24 · 9.12.4.26 · 9.12.4.29 · 9.12.4.30 · 9.12.4.35 · 9.12.4.37 · 9.12.4.38 · 9.12.4.39 · 9.12.4.40 · 9.12.4.41 · 9.12.4.47 · 9.12.4.48 · 9.12.4.50 · 9.12.4.52 · 9.12.4.54 · 9.12.4.55 · 9.12.4.56 · 9.12.4.58 · 9.12.4.62 · 9.12.4.65 · 9.12.4.67 · 9.14.1 · 9.14.1.6 · 9.14.1.10 · 9.14.1.15 · 9.14.1.19 · 9.14.1.30 · 9.14.2 · 9.14.2.4 · 9.14.2.8 · 9.14.2.13 · 9.14.2.15 · 9.14.3 · 9.14.3.1 · 9.14.3.9 · 9.14.3.11 · 9.14.3.13 · 9.14.3.15 · 9.14.3.18 · 9.14.4 · 9.14.4.6 · 9.14.4.7 · 9.14.4.12 · 9.14.4.13 · 9.14.4.14 · 9.14.4.15 · 9.14.4.17 · 9.14.4.22 · 9.14.4.23 · 9.14.4.24 · 9.15.1 · 9.15.1.1 · 9.15.1.7 · 9.15.1.10 · 9.15.1.15 · 9.15.1.16 · 9.15.1.17 · 9.15.1.21 · 9.16.1 · 9.16.1.28 · 9.16.2 · 9.16.2.3 · 9.16.2.7 · 9.16.2.11 · 9.16.2.13 · 9.16.2.14 · 9.16.3 · 9.16.3.3 · 9.16.3.14 · 9.16.3.15 · 9.16.3.19 · 9.16.3.23 · 9.16.4 · 9.16.4.9 · 9.16.4.14 · 9.16.4.18 · 9.16.4.19 · 9.16.4.27 · 9.16.4.38 · 9.16.4.39 · 9.16.4.42 · 9.16.4.48 · 9.16.4.55 · 9.16.4.57 · 9.16.4.61 · 9.17.1 · 9.17.1.7 · 9.17.1.9 · 9.17.1.10 · 9.17.1.11 · 9.17.1.13 · 9.17.1.15 · 9.17.1.20 · 9.17.1.30 · 9.17.1.33 · 9.17.1.39 · 9.18.1 · 9.18.1.3 · 9.18.2 · 9.18.2.5 · 9.18.2.7 · 9.18.2.8 · 9.18.3 · 9.18.3.39 · 9.18.3.46 · 9.18.3.53 · 9.18.3.55 · 9.18.3.56 · 9.18.4 · 9.18.4.5 · 9.18.4.8 · 9.18.4.22 · 9.18.4.24 · 9.19.1 · 9.19.1.5 · 9.19.1.9 · 9.19.1.12 · 9.19.1.18 · 9.19.1.22 · 9.19.1.24 · 9.19.1.27 · 9.19.1.28 · 9.19.1.31 · 9.20.1 · 9.20.1.5 · 9.20.2 · 9.20.2.10 · 9.20.2.21
nvd cisco secure firewall threat defense generic 6.2.3 · 6.2.3.1 · 6.2.3.2 · 6.2.3.3 · 6.2.3.4 · 6.2.3.5 · 6.2.3.6 · 6.2.3.7 · 6.2.3.8 · 6.2.3.9 · 6.2.3.10 · 6.2.3.11 · 6.2.3.12 · 6.2.3.13 · 6.2.3.14 · 6.2.3.15 · 6.2.3.16 · 6.2.3.17 · 6.2.3.18 · 6.4.0 · 6.4.0.1 · 6.4.0.2 · 6.4.0.3 · 6.4.0.4 · 6.4.0.5 · 6.4.0.6 · 6.4.0.7 · 6.4.0.8 · 6.4.0.9 · 6.4.0.10 · 6.4.0.11 · 6.4.0.12 · 6.4.0.13 · 6.4.0.14 · 6.4.0.15 · 6.4.0.16 · 6.4.0.17 · 6.4.0.18 · 6.6.0 · 6.6.0.1 · 6.6.1 · 6.6.3 · 6.6.4 · 6.6.5 · 6.6.5.1 · 6.6.5.2 · 6.6.7 · 6.6.7.1 · 6.6.7.2 · 6.7.0 · 6.7.0.1 · 6.7.0.2 · 6.7.0.3 · 7.0.0 · 7.0.0.1 · 7.0.1 · 7.0.1.1 · 7.0.2 · 7.0.2.1 · 7.0.3 · 7.0.4 · 7.0.5 · 7.0.6 · 7.0.6.1 · 7.0.6.2 · 7.1.0 · 7.1.0.1 · 7.1.0.2 · 7.1.0.3 · 7.2.0 · 7.2.0.1 · 7.2.1 · 7.2.2 · 7.2.3 · 7.2.4 · 7.2.4.1 · 7.2.5 · 7.2.5.1 · 7.2.5.2 · 7.2.6 · 7.2.7 · 7.2.8 · 7.2.8.1 · 7.3.0 · 7.3.1 · 7.3.1.1 · 7.3.1.2 · 7.4.0 · 7.4.1 · 7.4.1.1

References

URLTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20481 US Government Resource

Timeline
Published2024-10-23By the CVE Program.
VulnCheck KEV: earliest evidence2024-10-23Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2024-10-24Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2025-09-16Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-08-11NVD's own last-modified date for this record.