CERT-In Vulnerability Note
CIVN-2025-0074
Denial of Service Vulnerability in Cisco Meraki MX and Z Series
Original Issue Date:April 09, 2025
Severity Rating: HIGH
Component Affected
- Cisco Meraki
- MX64, MX64W, MX65, MX65W, MX67, MX67C, MX67W , MX68, MX68CW, MX68W, MX75, MX84 , MX85, MX95, MX100, MX105, MX250, M400, MX 450, MX600 , vMX , Z3, Z3C, Z4 , Z4C
Overview
A vulnerability has been reported in Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remote attacker to cause a denial of service (DoS) condition in the Cisco AnyConnect service on an affected device.
Target Audience:
All IT administrators and individuals responsible for maintaining and updating Cisco Meraki MX and Cisco Meraki Z Series devices.
Risk Assessment:
High risk of data manipulation and service disruption.
Impact Assessment:
Potential impact on confidentiality, integrity, and availability of the system.
Description
This vulnerability exists due to a variable is not initialized when an SSL VPN session is established. An attacker could exploit this vulnerability by supplying crafted attributes while establishing an SSL VPN session with an affected device.
Successful exploitation of this vulnerability could allow the attacker to cause the Cisco AnyConnect VPN server to restart, resulting in the failure of the established SSL VPN sessions and forcing remote users to initiate a new VPN connection and reauthenticate. A sustained attack could prevent new SSL VPN connections from being established.
Solution
Apply appropriate updates as mentioned in Cisco Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vNRpDvfb
Vendor Information
CISCO
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vNRpDvfb
References
CISCO
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vNRpDvfb
CVE Name
CVE-2025-20212
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|