Race condition in Cisco Meraki MX Firmware
Priority LOW 27CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (DoS) condition for individual users of the AnyConnect VPN service on an affected device. This vulnerability is due to weak entropy for handlers that are used during the VPN authentication process as well as a race condition that exists in the same process. An attacker could exploit this vulnerability by correctly guessing an authentication handler and then sending crafted HTTPS requests to an affected device. A successful exploit could allow the attacker to take over the AnyConnect VPN session from a target user or prevent the target user from establishing an AnyConnect VPN session with the affected device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Meraki MX Firmware | -16-2; -16-3; -16-4; -16-5; .16.6; -3; -6; -7; -8; -9; -10 | — | No fix listed | CNA |
- Cisco Meraki MX Firmware VendorCisco Affected -16-2; -16-3; -16-4; -16-5; .16.6; -3; -6; -7; -8; -9; -10 Fixed in — No fix listed CNA
CPE configurations NVD · 50
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:meraki_mx65_firmware:*:*:*:*:*:*:*:* | 17.6.0 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx65:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx64_firmware:*:*:*:*:*:*:*:* | 17.6.0 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx64:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_z4c_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_z4c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_z4_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_z4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_z3c_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_z3c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:meraki_mx65_firmware:*:*:*:*:*:*:*:* Versions 17.6.0 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx65:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx64_firmware:*:*:*:*:*:*:*:* Versions 17.6.0 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx64:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_z4c_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_z4c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_z4_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_z4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_z3c_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_z3c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 40 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:meraki_z3_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_z3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_vmx_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_vmx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx600_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx450_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx400_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx250_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx105_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx105:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx100_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx95_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx95:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx85_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx84_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx84:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx75_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx75:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx68w_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx68w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx68cw_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx68cw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx68_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx68:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx67w_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx67w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx67c_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx67c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx67_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx67:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx65w_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx65w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:meraki_mx64w_firmware:*:*:*:*:*:*:*:* | 16.2 to before 18.211.2 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:meraki_mx64w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:meraki_z3_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_z3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_vmx_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_vmx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx600_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx450_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx400_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx250_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx105_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx105:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx100_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx95_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx95:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx85_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx84_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx84:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx75_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx75:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx68w_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx68w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx68cw_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx68cw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx68_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx68:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx67w_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx67w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx67c_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx67c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx67_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx67:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx65w_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx65w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:meraki_mx64w_firmware:*:*:*:*:*:*:*:* Versions 16.2 to before 18.211.2 Vulnerable ·Cisco
- cpe:2.3:h:cisco:meraki_mx64w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-20509
- 2026-10-03 Alias added: GHSA-frxm-f6qg-2mch
References
Advisory 1
More Cisco Meraki Mx100 Firmware vulnerabilities
- TI-2022-05492 Cisco Meraki MX and Z3 Teleworker Gateway VPN Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2024-13425 Out-of-bounds write in Cisco Meraki MX Firmware CVSS 3.1HIGH 8.6
- TI-2024-13423 Out-of-bounds write in Cisco Meraki MX Firmware CVSS 3.1HIGH 8.6
- TI-2024-13422 Double free in Cisco Meraki MX Firmware CVSS 3.1HIGH 8.6
- TI-2024-13424 Uncontrolled resource consumption in Cisco Meraki MX Firmware CVSS 3.1HIGH 7.5
- TI-2024-13426 Uncontrolled resource consumption in Cisco Meraki MX Firmware CVSS 3.1HIGH 7.5
Sources
- CVE-2024-20509 · CVE Program
- CVE-2024-20509 · NVD
- FIRST EPSS
- GHSA-frxm-f6qg-2mch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences