Cisco Meraki MX and Z Series Teleworker Gateway AnyConnect VPN Session Takeover and Denial of Service Vulnerability

TL;DR 📌

A vulnerability has been identified in the Cisco AnyConnect VPN server of Cisco Meraki MX and Z Series Teleworker Gateway devices. This flaw could allow an unauthenticated remote attacker to hijack VPN sessions or cause denial of service (DoS) conditions for users. Cisco has released software updates to address this issue, and no workarounds are available.

What happened 🕵️‍♂️

A vulnerability in the Cisco AnyConnect VPN server could enable an unauthenticated remote attacker to hijack an AnyConnect VPN session or induce a denial of service (DoS) condition for users of the service. This vulnerability stems from weak entropy during the VPN authentication process and a race condition within the same process. Attackers can exploit this flaw by guessing an authentication handler and sending crafted HTTPS requests to the affected device.

Affected products 🖥️

The following Cisco Meraki products are affected if they are running a vulnerable release of Cisco Meraki MX firmware and have Cisco AnyConnect VPN enabled:

• MX64
• MX64W
• MX65
• MX65W
• MX67
• MX67C
• MX67W
• MX68
• MX68CW
• MX68W
• MX75
• MX84
• MX85
• MX95
• MX100
• MX105
• MX250
• MX400
• MX450
• MX600
• vMX
• Z3
• Z3C
• Z4
• Z4C

Note: Cisco AnyConnect VPN is supported on Cisco Meraki MX and Z Series devices running Cisco Meraki MX firmware releases 16.2 and later, except for MX64 and MX65, which require firmware releases 17.6 and later.

Fixed software 🔧

Upgrade to at least the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability. Cisco Meraki recommends upgrading devices to a fixed software release. Disabling Cisco AnyConnect VPN will eliminate the attack vector for this vulnerability, but this should be evaluated based on your specific environment and needs.

Risk in context 🎯

The vulnerability has a CVSS score of 5.8, categorized as medium severity. While the risk is not classified as critical, it is significant enough to warrant immediate attention, especially for organizations relying on the AnyConnect VPN service for secure remote access.

Fast facts ⚡

• Vulnerability ID: CVE-2024-20509
• CVSS Score: 5.8 (Medium)
• Initial Release Date: October 2, 2024
• Current Release Date: June 2, 2025
• Exploitation Awareness: No known malicious use reported.

For leadership 🧭

Executive summary. Remote workers connecting through Meraki MX or Z Series VPN gateways could have their sessions taken over or knocked offline by an attacker who never needed credentials, though no active exploitation has been reported. Given the exposure of the VPN server to the internet, this should be scheduled for the next available change window rather than left until a routine patch cycle.

Why it matters:

• The flaw sits in the Cisco AnyConnect VPN server itself, so any Meraki MX or Z Series device with AnyConnect enabled and exposed to remote users is a potential target
• Exploitation requires no authentication – an attacker only needs to guess an authentication handler and send crafted HTTPS requests to the device
• A successful attack can hijack an existing user’s VPN session, giving the attacker that user’s network access, or knock the session offline entirely
• The affected list spans nearly the whole current MX and Z Series line-up (MX64 through MX600, vMX, Z3/Z3C, Z4/Z4C), so most deployed teleworker gateways running AnyConnect are in scope

Now / Next / Later:

• Now: Identify which Meraki MX or Z Series devices in your estate have Cisco AnyConnect VPN enabled and check their firmware train against the fixed releases.
• Next: Upgrade affected devices to the first fixed release in their train during the next change window; where patching must wait, consider temporarily disabling AnyConnect VPN on exposed gateways after weighing the impact on remote access.
• Later: Build firmware currency checks for Meraki VPN gateways into routine patch management, since no workaround exists for this class of issue beyond disabling the service.