The version of the remote Cisco Meraki device is 16.2, 17, 18.1 prior to 18.1.07.12, or 18.2 prior to 18.2.11.2. It is, therefore, potentially affected by multiple vulnerabilities as referenced in the cisco-sa-meraki-mx-vpn-dos-QTRHzG2 advisory, including:

  - Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker     Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service     on an affected device. These vulnerabilities are due to insufficient validation of client-supplied parameters while     establishing an SSL VPN session. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request     to the VPN server of an affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect     VPN server to restart, resulting in the failure of the established SSL VPN connections and forcing remote users to     initiate a new VPN connection and reauthenticate. A sustained attack could prevent new SSL VPN connections from     being established. Note: When the attack traffic stops, the Cisco AnyConnect VPN server recovers gracefully without     requiring manual intervention. (CVE-2024-20498, CVE-2024-20499, CVE-2024-20501)

  - A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway     devices could allow an unauthenticated, remote attacker to cause a DoS condition in the AnyConnect service on an     affected device. This vulnerability is due to insufficient resource management when establishing TLS/SSL     sessions. An attacker could exploit this vulnerability by sending a series of crafted TLS/SSL messages to the VPN     server of an affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server     to stop accepting new connections, preventing new SSL VPN connections from being established. Existing SSL VPN     sessions are not impacted. Note: When the attack traffic stops, the Cisco AnyConnect VPN server recovers gracefully     without requiring manual intervention. (CVE-2024-20500)

  - A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway     devices could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This     vulnerability is due to insufficient resource management while establishing SSL VPN sessions. An attacker could     exploit this vulnerability by sending a series of crafted HTTPS requests to the VPN server of an affected device. A     successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to stop accepting new     connections, preventing new SSL VPN connections from being established. Existing SSL VPN sessions are not     impacted. Note: When the attack traffic stops, the Cisco AnyConnect VPN server recovers gracefully without requiring     manual intervention. (CVE-2024-20502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Cisco Meraki 16.2 / 17 / 18.1 < 18.1.07.12 / 18.2 < 18.2.11.2 Multiple Vulnerabilities (cisco-sa-meraki-mx-vpn-dos-QTRHzG2)

high Nessus Plugin ID 241198

Version 1.2