Cisco addressed CVE-2024-20481, an unauthenticated resource exhaustion flaw (CWE-772) in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerability stems from improper cleanup of authentication session contexts during high-volume connection attempts. Remote unauthenticated actors can flood an internet-facing gateway with rapid VPN login requests, exhausting memory pools and session tables to crash the RAVPN service, requiring a full device reload to restore client remote access.

The flaw was uncovered during global password-spraying and brute-force campaigns conducted by threat actors targeting enterprise perimeter appliances. The automated volume of authentication requests triggered the underlying resource leak, inadvertently inducing persistent denial-of-service conditions across production gateways. Following confirmation of active exploitation, CISA cataloged CVE-2024-20481 under its Known Exploited Vulnerabilities catalog. Cisco released software updates across affected ASA and FTD release trains, advising immediate installation.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unauthenticated pre-authentication resource starvation allows external adversaries to knock edge enterprise access gateways offline without valid credentials, bypassing ingress filtering and disabling critical administrative tunnels via standard automated login requests.
• Bullet 2 — Strategic & Defender Imperative: Security teams must deploy patched ASA and FTD releases immediately, configure external rate limiting, enforce aggressive login throttling, and restrict internet-facing RAVPN endpoints to trusted network blocks or geographically constrained ranges where possible.