SecBoard
Zurück zur CVE-Übersicht

CVE-2024-20481

MEDIUM(5.8)KEV — Aktiv ausgenutzt

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Risk Signal Score49/100 — MITTEL
  • CVSS 5.8 — Mittel
  • Im CISA KEV-Katalog (aktiv ausgenutzt)

CISA KEV

Bestätigt ausgenutzt

EPSS-Score

15.8%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.8

Technische Schwere

SecBoard-Einordnung

CVE-2024-20481 betrifft den Remote Access VPN (RAVPN)-Dienst der Cisco Adaptive Security Appliance (ASA) Software und Cisco Firepower Threat Defense (FTD) Software. Es handelt sich um eine Denial-of-Service (DoS)-Schwachstelle, die durch Ressourcenerschöpfung verursacht wird. Ein nicht authentifizierter, entfernter Angreifer kann durch das Senden einer großen Anzahl von VPN-Authentifizierungsanfragen den RAVPN-Dienst zum Absturz bringen.

KI-gestützte Einordnung auf Basis der NVD-Daten.

Beschreibung

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.

Erkennung & Indikatoren

Ausnutzung

Aktiv ausgenutzt (CISA KEV).

Threat-Hunting-Queries

Erkennung von DoS-Angriffen auf Cisco ASA/FTD RAVPN-Dienste durch hohe Anzahl fehlgeschlagener VPN-Authentifizierungsanfragen.

Sentinel/Defender KQL

CiscoASA
| where Message has_all ("%ASA-6-113005", "AAA user authentication Rejected")
| summarize RequestCount = count() by SourceIP, bin(TimeGenerated, 5m)
| where RequestCount > 50 // Schwellenwert anpassen
| project TimeGenerated, SourceIP, RequestCount, Message

Splunk SPL

index=cisco_asa "%ASA-6-113005" "AAA user authentication Rejected"
| stats count as RequestCount by src_ip, _time span 5m
| where RequestCount > 50 // Schwellenwert anpassen
| table _time, src_ip, RequestCount

Sigma

title: Cisco ASA/FTD RAVPN DoS Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential DoS attempts against Cisco ASA/FTD Remote Access VPN (RAVPN) services by monitoring for a high volume of failed authentication requests.
author: SecBoard
date: 2024/10/25
logsource:
  product: cisco
  service: asa
detection:
  selection:
    message|contains: 
      - '%ASA-6-113005'
      - 'AAA user authentication Rejected'
  timeframe: 5m
  condition: selection | count() > 50
  level: medium

Elastic ES|QL

FROM cisco_asa_logs
| WHERE message LIKE '%ASA-6-113005%' AND message LIKE '%AAA user authentication Rejected%'
| GROUP BY source_ip, fixed_window('5m')
| AGG count() AS request_count
| WHERE request_count > 50 // Schwellenwert anpassen
| SELECT @timestamp, source_ip, request_count

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.7:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.8:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.9:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.10:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.11:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.12:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.13:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.14:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.15:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.16:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.17:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.2.3.18:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:6.4.0:*:*:*:*:*:*:*

Referenzen