Cisco Meraki MX and Z Series Teleworker Gateway AnyConnect VPN Session Takeover

🚨SEVERITY: MEDIUM — CVSS 5.8Security Advisory

TL;DR 📌

  • A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (DoS) condition for individual users of the AnyConnect VPN service on an affected device. This vulnerability is…
  • Highest CVSS: 5.8 (Medium).
  • Fix available — see the first fixed release below.
  • CVEs: CVE-2024-20509.

What it is

CVE-2024-20509 affects the Cisco AnyConnect VPN server component on Cisco Meraki MX Series and Meraki Z Series Teleworker Gateway devices. The issue arises from weak entropy in the handlers used during VPN authentication, combined with a race condition in the same authentication process.

An unauthenticated, remote attacker can exploit this over the network by correctly guessing an authentication handler value and sending crafted HTTPS requests to the affected device. No credentials or prior access are needed — this sits on the AnyConnect VPN authentication path, not the management dashboard.

A successful exploit lets the attacker either hijack an existing AnyConnect VPN session belonging to a target user, or prevent that user from establishing a session at all (denial of service). The impact is scoped to individual users’ sessions rather than the device as a whole.

The vulnerability only applies where Cisco AnyConnect VPN is enabled on the device. Meraki MX firmware supports AnyConnect VPN from release 16.2 onward, except MX64 and MX65, which only support it from 17.6 onward.

What to do

  • Check whether AnyConnect VPN is enabled: in Dashboard, go to Security Appliance > Configure > Client VPN (or Teleworker gateway > Configure > Client VPN for Z Series) and review the AnyConnect Settings tab. If it’s disabled or the tab isn’t present, the device isn’t affected.
  • Upgrade affected devices to a fixed release: 18.107.13 for the 18.1 branch, or 18.211.3 for the 18.2 branch.
  • Devices on MX firmware 16.2 or 17.x need to migrate to one of the fixed releases above — there is no in-branch fix for those versions.
  • There is no workaround from Cisco other than upgrading. If an upgrade can’t happen immediately, disabling AnyConnect VPN removes the attack vector, but Cisco notes this should be evaluated against your own environment before deploying, as it removes VPN functionality for those users.
  • MX64 and MX65 devices are only affected when running firmware 17.6 or later — confirm the running version before assuming exposure.
  • This is not listed in CISA’s Known Exploited Vulnerabilities catalogue.

Fixed releases

Affected release First fixed release
18.1 18.107.13
18.2 18.211.3

For leadership 🧭

Executive summary. An unauthenticated attacker who can reach a Meraki MX or Z Series device’s AnyConnect VPN service could take over or block a specific remote worker’s VPN session by guessing an authentication value and sending crafted requests. This affects individual sessions rather than the whole device, so it warrants scheduling a firmware upgrade in the next change window rather than an emergency response.

Why it matters:

  • The flaw sits in the AnyConnect VPN authentication path itself, not the management dashboard, so no prior access or credentials are needed to attempt exploitation over HTTPS.
  • A successful attack lets someone hijack a specific remote user’s live VPN session, gaining whatever network access that session provides, or simply stop that user connecting.
  • Exposure is limited to devices with AnyConnect VPN enabled, which includes most Meraki MX firmware from 16.2 onward (17.6 onward for MX64/MX65), so many deployed teleworker gateways are in scope.
  • There is no vendor workaround other than upgrading; the only interim mitigation is disabling AnyConnect VPN, which removes VPN access for affected users.

Now / Next / Later:

  • Now: Check in Dashboard whether AnyConnect VPN is enabled on each Meraki MX or Z Series device (Security Appliance or Teleworker gateway > Configure > Client VPN, AnyConnect Settings tab) to identify which devices are actually exposed.
  • Next: Upgrade exposed devices to a fixed release — 18.107.13 on the 18.1 branch or 18.211.3 on the 18.2 branch — migrating any device still on 16.2 or 17.x firmware, including MX64/MX65 units running 17.6 or later.
  • Later: Where upgrades can’t be scheduled immediately, disable AnyConnect VPN on the affected devices after assessing the impact on remote users, and build Meraki firmware version checks into routine patch reviews given AnyConnect support spans multiple branches.

Source