---
title: "Cisco ASA/FTD CVE-2024-20481: VPN Password-Spray DoS"
url: https://erroneo.us/security/briefs/cisco-asa-ftd-ravpn-brute-force-dos-cve-2024-20481/
description: "Mass VPN login attempts could exhaust Cisco ASA and FTD remote access VPN. Exploited in 2024 spray campaigns. Confirm upgrades and spray defenses."
type: security-brief
section: "Security Digest"
date_published: 2024-10-23
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-20481"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco ASA/FTD CVE-2024-20481: VPN Password-Spray DoS

**Verdict: Check exposure.** A 2024 VPN outage bug, fixed for two years; the real risk today is an ASA or FTD headend still on a 2024-era build, which also misses fixes for the exploited 2025 and 2026 VPN bugs.

- **Who must act:** Owners of Cisco ASA or FTD devices with remote access VPN enabled that have not been upgraded since October 2024, or that run trains with no current fixes.
- **Who can relax:** Devices without SSL VPN enabled, Secure Firewall Management Center, and VPN headends already on releases that fix CVE-2026-20349.
- **Affected:** Cisco ASA releases listed in the CVE record, from 9.8 through 9.20.2.21, with remote access VPN enabled; Cisco FTD releases listed in the CVE record, from 6.2.3 through 7.4.1.1, with remote access VPN enabled
- **Fixed:** Fixed releases per train via the Cisco Software Checker (the advisory lists no build numbers); Current target: the CVE-2026-20349 fixed builds, e.g. ASA 9.20.4.49, 9.22.3.26, 9.24.1.26; FTD 7.2.12, 7.4.8, 7.6.6
- **CVEs:** CVE-2024-20481
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check every ASA and FTD with show version and show running-config webvpn | include ^ enable.
2. Upgrade VPN headends to the current fixed release for their train, at least the CVE-2026-20349 builds, using the Cisco Software Checker.
3. Migrate devices on trains with no current fixes, such as ASA 9.17 and 9.19 or FTD 7.1 and 7.3.
4. Enable threat detection for remote access VPN services where the release supports it.
5. Otherwise disable AAA authentication and Hostscan on DefaultWEBVPNGroup and DefaultRAGroup, and use group-URLs instead of group-aliases.
6. Send ASA syslog at informational level to a remote collector so password spraying is visible.

### How to check if you are affected

- Look for large volumes of %ASA-6-113005, %ASA-6-113015 and %ASA-6-716039 messages (rejected AAA and WebVPN logins).
- Run show aaa-server several times a short interval apart; fast-rising request and reject counters suggest an active spray.
- Treat intermittent 'Unable to complete connection. Cisco Secure Desktop not installed on the client.' errors as a sign this bug was triggered.
- Check for successful VPN logins from spray sources, since a spray that works is an account compromise, not just an outage.

## What happened

On October 23, 2024, Cisco published [an advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW) for CVE-2024-20481, a resource exhaustion flaw (CWE-772) in the Remote Access VPN (RAVPN) service of Cisco ASA and Firepower Threat Defense (FTD) software. A flood of VPN authentication requests from an unauthenticated attacker can exhaust resources and take RAVPN down, sometimes until a reload. Other services keep working. Cisco scores it CVSS 3.1 5.8 (Medium), and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-20481) agrees. Cisco says it is aware of malicious use.

That malicious use was password spraying. Cisco first published its [password spray TechNote](https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html) for RAVPN on March 26, 2024. On April 16, [Cisco Talos](https://blog.talosintelligence.com/large-scale-brute-force-activity-targeting-vpns-ssh-services-with-commonly-used-login-credentials/) reported brute-force activity, running since at least March 18, against Cisco, Checkpoint, Fortinet, SonicWall and other VPN and SSH services. The traffic came through TOR and proxy services and mixed generic usernames with real ones for targeted organizations. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-20481) cites that Talos post. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20481) on October 24, 2024.

## Who is affected

ASA and FTD devices with RAVPN enabled on an affected release. If `show running-config webvpn | include ^ enable` returns nothing, SSL VPN is off and the device is not affected. The CVE record lists affected ASA releases from 9.8 through 9.20.2.21 and FTD releases from 6.2.3 through 7.4.1.1. The advisory prints no fixed build numbers and points to the Cisco Software Checker instead. Secure Firewall Management Center, IOS, IOS XE, Meraki and NX-OS are not affected.

## Do you really need to act?

Not for this bug alone, if your VPN headends were upgraded at any point since late 2024. The impact is a VPN outage, not a compromise, and upgrading is the only fix.

The reason to check anyway is what an old build implies. An ASA or FTD still on a pre-October 2024 release also lacks the fixes for CVE-2025-20333 and CVE-2025-20362, the ArcaneDoor chain that gave attackers root, and for CVE-2026-20349, a one-request VPN crash exploited in August 2026. The [CVE-2026-20349 fixed builds](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF), such as ASA 9.20.4.49 and 9.24.1.26 or FTD 7.4.8 and 7.6.6, are newer than every release listed as affected here. Password spraying against VPN portals has also not stopped.

## What to do now

1. On each device, note the release from `show version` and run `show running-config webvpn | include ^ enable`.
2. Upgrade VPN headends to the current fixed release for their train, at least the CVE-2026-20349 builds, and confirm the choice in the Cisco Software Checker. Move trains with no current fixes, such as ASA 9.17 and 9.19 or FTD 7.1 and 7.3, to a supported train.
3. Enable threat detection for RAVPN services. It shuns sources of repeated failed logins, client initiation attacks and connections to invalid tunnel groups. The TechNote lists minimum releases, for example ASA 9.20(3) and FTD 7.2.9.
4. Where that is unavailable, disable AAA authentication and Hostscan on the DefaultWEBVPNGroup and DefaultRAGroup profiles, and use group-URLs instead of group-aliases.
5. Send syslog at informational level (6) to a remote collector.

## How to tell if you were hit

This bug leaves outage evidence, not a foothold. Cisco's indicators are large volumes of `%ASA-6-113005`, `%ASA-6-113015` and `%ASA-6-716039` messages, which record rejected AAA and WebVPN logins. Run `show aaa-server` a few times, pausing between runs; fast-rising reject counters suggest an active spray. The TechNote adds that intermittent "Unable to complete connection. Cisco Secure Desktop not installed on the client." errors can mean this bug is being triggered. Also look for successful logins from the spraying sources: a spray that works is an account compromise.

## Timeline

- Mar 18, 2024 — Talos starts tracking the brute-force campaign.
- Mar 26, 2024 — Cisco publishes its first password spray TechNote for RAVPN.
- Apr 16, 2024 — Talos publishes its report.
- Oct 23, 2024 — Cisco publishes the advisory and fixed software.
- Oct 24, 2024 — CISA adds CVE-2024-20481 to KEV, with a November 14 deadline.
- Aug 11, 2026 — Cisco discloses CVE-2026-20349, a newer exploited RAVPN crash bug.

## Sources

1. [Cisco — ASA and FTD Software Remote Access VPN Brute Force Denial of Service Vulnerability (cisco-sa-asaftd-bf-dos-vDZhLqrW)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW)
2. [Cisco — Mitigate Password Spray Attacks on Remote VPN Secure Firewall (TechNote 221806)](https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html)
3. [Cisco Talos — Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials](https://blog.talosintelligence.com/large-scale-brute-force-activity-targeting-vpns-ssh-services-with-commonly-used-login-credentials/)
4. [CVE record — CVE-2024-20481](https://www.cve.org/CVERecord?id=CVE-2024-20481)
5. [NVD — CVE-2024-20481](https://nvd.nist.gov/vuln/detail/CVE-2024-20481)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-20481](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20481)
7. [Cisco — Secure Firewall ASA and FTD Remote Access SSL VPN Denial of Service Vulnerability (cisco-sa-asaftd-vpn-dos-dzv4mQFF, CVE-2026-20349)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF)

---
Source page: https://erroneo.us/security/briefs/cisco-asa-ftd-ravpn-brute-force-dos-cve-2024-20481/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt