Cisco ASA/FTD CVE-2024-20481: VPN Password-Spray DoS

What to do

1. Check every ASA and FTD with show version and show running-config webvpn | include ^ enable.
2. Upgrade VPN headends to the current fixed release for their train, at least the CVE-2026-20349 builds, using the Cisco Software Checker.
3. Migrate devices on trains with no current fixes, such as ASA 9.17 and 9.19 or FTD 7.1 and 7.3.
4. Enable threat detection for remote access VPN services where the release supports it.
5. Otherwise disable AAA authentication and Hostscan on DefaultWEBVPNGroup and DefaultRAGroup, and use group-URLs instead of group-aliases.
6. Send ASA syslog at informational level to a remote collector so password spraying is visible.

How to check if you are affected or compromised

• Look for large volumes of %ASA-6-113005, %ASA-6-113015 and %ASA-6-716039 messages (rejected AAA and WebVPN logins).
• Run show aaa-server several times a short interval apart; fast-rising request and reject counters suggest an active spray.
• Treat intermittent 'Unable to complete connection. Cisco Secure Desktop not installed on the client.' errors as a sign this bug was triggered.
• Check for successful VPN logins from spray sources, since a spray that works is an account compromise, not just an outage.

What happened#

On October 23, 2024, Cisco published an advisory for CVE-2024-20481, a resource exhaustion flaw (CWE-772) in the Remote Access VPN (RAVPN) service of Cisco ASA and Firepower Threat Defense (FTD) software. A flood of VPN authentication requests from an unauthenticated attacker can exhaust resources and take RAVPN down, sometimes until a reload. Other services keep working. Cisco scores it CVSS 3.1 5.8 (Medium), and NVD agrees. Cisco says it is aware of malicious use.

That malicious use was password spraying. Cisco first published its password spray TechNote for RAVPN on March 26, 2024. On April 16, Cisco Talos reported brute-force activity, running since at least March 18, against Cisco, Checkpoint, Fortinet, SonicWall and other VPN and SSH services. The traffic came through TOR and proxy services and mixed generic usernames with real ones for targeted organizations. The CVE record cites that Talos post. CISA added the CVE to the KEV catalog on October 24, 2024.

Who is affected#

ASA and FTD devices with RAVPN enabled on an affected release. If show running-config webvpn | include ^ enable returns nothing, SSL VPN is off and the device is not affected. The CVE record lists affected ASA releases from 9.8 through 9.20.2.21 and FTD releases from 6.2.3 through 7.4.1.1. The advisory prints no fixed build numbers and points to the Cisco Software Checker instead. Secure Firewall Management Center, IOS, IOS XE, Meraki and NX-OS are not affected.

Do you really need to act?#

Not for this bug alone, if your VPN headends were upgraded at any point since late 2024. The impact is a VPN outage, not a compromise, and upgrading is the only fix.

The reason to check anyway is what an old build implies. An ASA or FTD still on a pre-October 2024 release also lacks the fixes for CVE-2025-20333 and CVE-2025-20362, the ArcaneDoor chain that gave attackers root, and for CVE-2026-20349, a one-request VPN crash exploited in August 2026. The CVE-2026-20349 fixed builds, such as ASA 9.20.4.49 and 9.24.1.26 or FTD 7.4.8 and 7.6.6, are newer than every release listed as affected here. Password spraying against VPN portals has also not stopped.

What to do now#

1. On each device, note the release from show version and run show running-config webvpn | include ^ enable.
2. Upgrade VPN headends to the current fixed release for their train, at least the CVE-2026-20349 builds, and confirm the choice in the Cisco Software Checker. Move trains with no current fixes, such as ASA 9.17 and 9.19 or FTD 7.1 and 7.3, to a supported train.
3. Enable threat detection for RAVPN services. It shuns sources of repeated failed logins, client initiation attacks and connections to invalid tunnel groups. The TechNote lists minimum releases, for example ASA 9.20(3) and FTD 7.2.9.
4. Where that is unavailable, disable AAA authentication and Hostscan on the DefaultWEBVPNGroup and DefaultRAGroup profiles, and use group-URLs instead of group-aliases.
5. Send syslog at informational level (6) to a remote collector.

How to tell if you were hit#

This bug leaves outage evidence, not a foothold. Cisco's indicators are large volumes of %ASA-6-113005, %ASA-6-113015 and %ASA-6-716039 messages, which record rejected AAA and WebVPN logins. Run show aaa-server a few times, pausing between runs; fast-rising reject counters suggest an active spray. The TechNote adds that intermittent "Unable to complete connection. Cisco Secure Desktop not installed on the client." errors can mean this bug is being triggered. Also look for successful logins from the spraying sources: a spray that works is an account compromise.

Timeline#

• Mar 18, 2024 — Talos starts tracking the brute-force campaign.
• Mar 26, 2024 — Cisco publishes its first password spray TechNote for RAVPN.
• Apr 16, 2024 — Talos publishes its report.
• Oct 23, 2024 — Cisco publishes the advisory and fixed software.
• Oct 24, 2024 — CISA adds CVE-2024-20481 to KEV, with a November 14 deadline.
• Aug 11, 2026 — Cisco discloses CVE-2026-20349, a newer exploited RAVPN crash bug.

Vulnerability records

• CVE-2024-20481 · KEV 2024-10-24 · A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Cisco — ASA and FTD Software Remote Access VPN Brute Force Denial of Service Vulnerability (cisco-sa-asaftd-bf-dos-vDZhLqrW) sec.cloudapps.cisco.com
2. Cisco — Mitigate Password Spray Attacks on Remote VPN Secure Firewall (TechNote 221806) cisco.com
3. Cisco Talos — Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials blog.talosintelligence.com
4. CVE record — CVE-2024-20481 cve.org
5. NVD — CVE-2024-20481 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2024-20481 cisa.gov
7. Cisco — Secure Firewall ASA and FTD Remote Access SSL VPN Denial of Service Vulnerability (cisco-sa-asaftd-vpn-dos-dzv4mQFF, CVE-2026-20349) sec.cloudapps.cisco.com