{"id":"CVE-2024-20481","kind":"vulnerability","aliases":["CVE-2024-20481"],"related":[],"title":"cisco secure firewall threat defense: A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and…","description":"A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service.\r\n\r This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected.\r\n\r Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.","summary":"Cisco ASA and Firepower Threat Defense firewalls have a resource leak that lets an unauthenticated remote attacker crash or deny service to the remote access VPN (RAVPN) service. CISA lists it as actively exploited.","severity":"high","cvss":5.8,"epss":null,"exploited":true,"exploited_at":"2024-10-24T00:00:00+00:00","products":[{"name":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.1","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.2","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.3","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.4","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.5","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.6","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.7","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.8","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.9","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.10","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.11","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.12","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.13","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.14","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.15","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.16","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.17","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.2.3.18","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.1","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.2","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.3","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.4","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.5","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.6","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.7","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.8","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.9","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.10","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.11","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.12","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.13","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.14","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.15","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.16","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.17","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.4.0.18","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.6.0","ecosystem":"vendor"},{"name":"cisco secure firewall threat defense","fixed":[],"affected":"= 6.6.0.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asa","cisco","exploited","firepower","ftd","infrastructure","remote-access-vpn"],"not_affected_if":["no-ravpn-enabled"],"how_to_check":"Check whether the device runs remote access VPN (RAVPN) and which ASA or FTD software version it is on; the sources do not give a specific command.","fix":"Apply the mitigations and fixed releases from Cisco's advisory; the sources do not name the version. If no mitigation is available, CISA says to discontinue use of the product.","status":"open","published_at":"2024-10-23T18:15:11+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:22+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:56:22Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and fixed releases from Cisco's advisory; the sources do not name the version. If no mitigation is available, CISA says to discontinue use of the product.","reach":"internet","impact":"medium","summary":"Cisco ASA and Firepower Threat Defense firewalls have a resource leak that lets an unauthenticated remote attacker crash or deny service to the remote access VPN (RAVPN) service. CISA lists it as actively exploited.","category":"infrastructure","who_cares":["cisco","asa","ftd","firepower","remote-access-vpn"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote access VPN service on the firewall is knocked offline by an unauthenticated attacker.","analyst_note":"Find the fixed versions and mitigation steps in Cisco's security advisory for CVE-2024-20481 and add them to how_to_check and fix.","how_to_check":"Check whether the device runs remote access VPN (RAVPN) and which ASA or FTD software version it is on; the sources do not give a specific command.","needs_analyst":true,"not_affected_if":["no-ravpn-enabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000509,"input_tokens":2915,"output_tokens":436,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':23A,26A '-20481':24A,27A 'access':11A,246B,272B,287C 'activ':280B,415C 'adapt':17A,293C 'adaptive':29A 'affect':346C,368C,399C 'allow':306C,352C 'and':33A 'applianc':19A,295C 'appliance':31A 'asa':20A,32A,238B,249B,296C 'attack':264B,310C,330C,354C,376C,404C 'authent':342C 'blog':407C 'brute':413C 'brute-forc':412C 'caus':312C 'cisa':276B 'cisco':1A,16A,28A,38A,43A,48A,53A,58A,63A,68A,73A,78A,83A,88A,93A,98A,103A,108A,113A,118A,123A,128A,133A,138A,143A,148A,153A,158A,163A,168A,173A,178A,183A,188A,193A,198A,203A,208A,213A,218A,223A,228A,233A,239B,248B,292C,299C,400C 'common':421C 'could':305C,331C,351C 'crash':265B 'credenti':424C 'cve':22A,25A 'defens':5A,253B,302C 'defense':36A,42A,47A,52A,57A,62A,67A,72A,77A,82A,87A,92A,97A,102A,107A,112A,117A,122A,127A,132A,137A,142A,147A,152A,157A,162A,167A,172A,177A,182A,187A,192A,197A,202A,207A,212A,217A,222A,227A,232A,237A 'deni':267B 'denial':314C 'depend':370C 'devic':347C,369C,381C 'discuss':402C 'dos':317C,361C 'due':325C 'exhaust':328C,356C 'exploit':240B,281B,332C,350C 'firepow':241B,251B,300C 'firepower':34A 'firewal':3A,254B 'firewall':40A,45A,50A,55A,60A,65A,70A,75A,80A,85A,90A,95A,100A,105A,110A,115A,120A,125A,130A,135A,140A,145A,150A,155A,160A,165A,170A,175A,180A,185A,190A,195A,200A,205A,210A,215A,220A,225A,230A,235A 'forc':414C 'ftd':37A,242B,303C 'impact':373C 'infrastructur':243B 'larg':338C,410C 'large-scal':409C 'leak':258B 'let':260B 'list':277B 'login':423C 'may':382C 'number':339C 'post':408C 'ravpn':13A,274B,289C,320C,364C,388C 'relat':394C 'reload':378C 'remot':10A,245B,263B,271B,286C,309C 'remote-access-vpn':244B 'request':343C 'requir':384C 'resourc':257B,327C,357C 'restor':386C 'result':358C 'scale':411C 'secur':2A,18A,294C 'secure':39A,44A,49A,54A,59A,64A,69A,74A,79A,84A,89A,94A,99A,104A,109A,114A,119A,124A,129A,134A,139A,144A,149A,154A,159A,164A,169A,174A,179A,184A,189A,194A,199A,204A,209A,214A,219A,224A,229A,234A 'security':30A 'send':336C 'servic':14A,268B,275B,290C,316C,321C,365C,389C,390C,419C 'softwar':21A,297C,304C 'ssh':418C 'success':349C 'talo':401C 'target':416C 'threat':4A,35A,41A,46A,51A,56A,61A,66A,71A,76A,81A,86A,91A,96A,101A,106A,111A,116A,121A,126A,131A,136A,141A,146A,151A,156A,161A,166A,171A,176A,181A,186A,191A,196A,201A,206A,211A,216A,221A,226A,231A,236A,252B,301C 'unauthent':262B,308C 'use':422C 'vpn':12A,247B,273B,288C,341C,396C 'vpns':417C 'vulner':7A,283C,323C,334C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-23T18:15:11+00:00","kev":{"dateAdded":"2024-10-24","dueDate":"2024-11-14","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-20481","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20481","severity":null,"published_at":"2024-10-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-20481","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20481","severity":null,"published_at":"2024-10-23T18:15:11+00:00","modified_at":"2026-08-11T19:40:47+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}