EUVD-2025-18656CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
3Description
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the Cisco AnyConnect service on an affected device. This vulnerability is due to variable initialization errors when an SSL VPN session is established. An attacker could exploit this vulnerability by sending a sequence of crafted HTTPS requests to an affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to restart, resulting in the failure of all established SSL VPN sessions and forcing remote users to initiate a new VPN connection and re-authenticate. A sustained attack could prevent new SSL VPN connections from being established, effectively making the Cisco AnyConnect VPN service unavailable for all legitimate users.
Analysis
Remote denial-of-service vulnerability in the Cisco AnyConnect VPN server affecting Cisco Meraki MX and Z Series Teleworker Gateway devices. An unauthenticated attacker can exploit variable initialization errors during SSL VPN session establishment by sending crafted HTTPS requests, causing the AnyConnect service to restart and disconnecting all active VPN sessions while blocking new connections. With a CVSS score of 8.6 and network-exploitable attack vector requiring no authentication, this vulnerability poses significant risk to organizations relying on these devices for remote access infrastructure.
Technical Context
The vulnerability stems from CWE-457 (Use of Uninitialized Variable) in the SSL/TLS handshake processing logic of the Cisco AnyConnect VPN service. When an SSL VPN session is established, improper variable initialization creates a memory safety condition that can be triggered remotely. The affected products are Cisco Meraki MX Series (aggregate router/security appliance) and Cisco Meraki Z Series (Teleworker Gateway devices), which serve as enterprise VPN concentrators. The vulnerability exists in the HTTPS-based VPN session negotiation pathway, making it exploitable over the network without requiring valid VPN credentials. The root cause relates to unsafe memory handling in the VPN protocol state machine rather than application-level authentication bypass.
Affected Products
Cisco Meraki MX Series Teleworker Gateway (exact versions from CVE description not specified but include current and recent versions); Cisco Meraki Z Series Teleworker Gateway (exact versions not specified). CPE strings likely include: cpe:2.3:a:cisco:meraki_mx:*:*:*:*:*:*:*:* and cpe:2.3:a:cisco:meraki_z:*:*:*:*:*:*:*:*. Affected component is specifically the bundled Cisco AnyConnect VPN server on these devices. Cisco's advisory should clarify exact firmware versions; all versions prior to the patched release are assumed vulnerable. Organizations should cross-reference their Meraki device firmware version against the Cisco security advisory (cisco.com/security) for definitive version mapping.
Remediation
Apply Cisco firmware updates addressing CVE-2025-20271 to affected Meraki MX and Z Series devices. Contact Cisco or check Cisco Meraki Dashboard for available firmware patches. Interim mitigations pending patch deployment: (1) Implement network-based rate limiting on HTTPS VPN ports to reduce DOS attack surface; (2) Deploy IPS/IDS signatures detecting malformed HTTPS VPN session requests if available; (3) Enable AnyConnect service redundancy/failover if configured; (4) Restrict VPN gateway access to known/trusted source IP ranges via firewall rules; (5) Monitor AnyConnect service restart events for anomalies indicating exploitation attempts. Workarounds are limited given the pre-authentication attack vector; patching is the definitive remediation. Once patched, restart devices to apply changes or schedule maintenance windows if device supports in-service firmware updates.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today