Cisco Meraki MX and Z Series Teleworker Gateway AnyConnect VPN Denial of Service Vulnerabilities

TL;DR 📌

Cisco Meraki MX and Z Series Teleworker Gateway devices are affected by multiple denial of service (DoS) vulnerabilities in the AnyConnect VPN server. These vulnerabilities could allow an unauthenticated attacker to disrupt VPN services. Cisco has released software updates to address these issues, and there are no workarounds available.

What happened 🕵️‍♂️

Multiple vulnerabilities have been identified in the Cisco AnyConnect VPN server of Cisco Meraki MX and Z Series Teleworker Gateway devices. An unauthenticated, remote attacker could exploit these vulnerabilities to cause a denial of service (DoS) condition, resulting in the failure of established SSL VPN connections and preventing new connections from being established.

Affected products 🖥️

The following Cisco Meraki products are affected if they are running a vulnerable release of Cisco Meraki MX firmware with Cisco AnyConnect VPN enabled:

• MX64
• MX64W
• MX65
• MX65W
• MX67
• MX67C
• MX67W
• MX68
• MX68CW
• MX68W
• MX75
• MX84
• MX85
• MX95
• MX100
• MX105
• MX250
• MX400
• MX450
• MX600
• vMX
• Z3
• Z3C
• Z4
• Z4C

Note: Cisco AnyConnect VPN is supported on Cisco Meraki MX Series and Z Series devices running firmware releases 16.2 and later, except for MX64 and MX65, which require firmware releases 17.6 and later.

Fixed software 🔧

Upgrade to at least the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that effectively address these vulnerabilities. Cisco Meraki recommends disabling Cisco AnyConnect VPN as a temporary mitigation, but this may impact functionality. Customers should evaluate the applicability of this mitigation in their environments.

Risk in context 🎯

The highest CVSS score for these vulnerabilities is 8.6, indicating a high severity level. Exploitation could lead to significant disruption of VPN services, affecting remote users’ ability to connect securely. Organizations using affected devices should prioritize applying the recommended software updates to mitigate these risks.

Fast facts ⚡

• Advisory ID: cisco-sa-meraki-mx-vpn-dos-QTRHzG2
• Initial Release Date: October 2, 2024
• Current Release Date: June 2, 2025
• CVSS Base Score: 8.6 (High)
• Vulnerabilities: CVE-2024-20498, CVE-2024-20499, CVE-2024-20501, CVE-2024-20502, CVE-2024-20513

For leadership 🧭

Executive summary. Remote workers relying on Meraki MX or Z series VPN gateways could lose their VPN connections without warning, and no login is needed to trigger it. There’s no workaround beyond disabling AnyConnect VPN entirely, so patching should be scheduled as soon as a maintenance window allows.

Why it matters:

• The five CVEs all hit the AnyConnect VPN server component on Meraki MX and Z series gateways, meaning a single attacker with network reach to the VPN endpoint can knock out remote access.
• No authentication is required to trigger the denial of service, so exposure is tied purely to whether the AnyConnect VPN service is reachable from the internet.
• Cisco has confirmed there is no effective workaround other than turning off AnyConnect VPN, which removes remote access functionality entirely rather than mitigating the risk.
• The affected list spans the full current MX and Z hardware range plus vMX, so most organisations running Meraki for teleworker VPN are in scope if AnyConnect is enabled.

Now / Next / Later:

• Now: Identify which Meraki MX or Z series devices have Cisco AnyConnect VPN enabled and check their firmware version against the fixed releases in the advisory.
• Next: Schedule a maintenance window to upgrade affected MX and Z series gateways to the first fixed firmware release for their train; where a fix isn’t yet available for a device’s train, plan to disable AnyConnect VPN temporarily if remote access disruption is unacceptable to leave unpatched.
• Later: Build Meraki firmware updates into a regular patch cycle tied to Cisco security advisories, since this AnyConnect VPN server component has needed fixes across five separate CVEs in this one advisory.