Dive Brief:
- A vulnerability that can lead to denial of service in the remote access VPN service of Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense is facing active exploitation, according to the company.
- Though the vulnerability, listed as CVE-2024-20481, only has a CVSS score of 5.8, it can allow an unauthenticated attacker to cause a denial of service to the remote access VPN service, according to an advisory released Wednesday from Cisco.
- The Cybersecurity and Infrastructure Security Agency on Thursday added the CVE to its known exploited vulnerabilities catalog.
Dive Insight:
Attackers can send a large number of VPN authentication requests to affected devices to exploit the vulnerability, according to Cisco. A successful attack exhausts resources, which leads to a denial of service on the remote access VPN service on the targeted device.
Cisco said while there are no workarounds, there are mitigations available for users that are dealing with password spray attacks.
The Cisco Product Security Incident Response Team said it is aware of malicious use of the vulnerability disclosed in the advisory. The vulnerability was found during the resolution of a Cisco technical assistance center support case.
Researchers from Cisco Talos previously raised concerns about these types of attacks in April. At the time, researchers were monitoring a global surge in brute-force attacks targeting VPN services, web application authentication interfaces and secure shell services dating back to mid-March.
The attacks Cisco Talos cited in April could lead to unauthorized network access, account lockouts and denial of service. Those attacks also impacted a wide range of services, including VPNs from Cisco Secure Firewall, Check Point, Fortinet and SonicWall, among others.
The attacks at the time originated from Tor exit nodes as well as other anonymizing tunnels, according to Cisco Talos.
Attackers have increasingly exploited vulnerabilities targeting VPNs to hack into systems in recent months. Attackers previously targeted vulnerabilities in Check Point Software VPNs.
