CVE-2024-20513: Cisco Meraki MX Firmware · Insecure Direct Object Reference
Affects Cisco Meraki MX FirmwareSource CVE Database V5
Not known to be exploited · CVSS 5.8 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 2 Oct 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations using Cisco Meraki MX or Z Series devices should take the following specific actions: 1) Immediately review current firmware versions and configurations of affected devices to identify exposure. 2) Monitor Cisco’s official security advisories and Meraki dashboard notifications for patches or firmware updates addressing CVE-2024-20513 and apply them promptly once available. 3) Implement network-level protections such as rate limiting and anomaly detection on VPN endpoints to detect and block brute force attempts targeting session handlers. 4) Enforce multi-factor authentication (MFA) for VPN access to reduce risk from authenticated attackers attempting to retrieve session handlers. 5) Consider segmenting VPN infrastructure and restricting management access to trusted networks to reduce attack surface. 6) Maintain robust incident response plans to quickly identify and mitigate DoS conditions affecting VPN services. 7) Educate IT staff on recognizing symptoms of session termination attacks and ensure logging and alerting are enabled on VPN devices to detect unusual session activity. These targeted measures go beyond generic advice by focusing on the specific attack vector and operational context of Cisco Meraki VPN deployments.
Description
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a DoS condition for targeted users of the AnyConnect service on an affected device. This vulnerability is due to insufficient entropy for handlers that are used during SSL VPN session establishment. An unauthenticated attacker could exploit this vulnerability by brute forcing valid session handlers. An authenticated attacker could exploit this vulnerability by connecting to the AnyConnect VPN service of an affected device to retrieve a valid session handler and, based on that handler, predict further valid session handlers. The attacker would then send a crafted HTTPS request using the brute-forced or predicted session handler to the AnyConnect VPN server of the device. A successful exploit could allow the attacker to terminate targeted SSL VPN sessions, forcing remote users to initiate new VPN connections and reauthenticate.