CVE-2025-20271: Cisco Meraki VPN Bug Exposes MX and Z Series Devices to Remote DoS Attacks
Ddos 
Cisco has disclosed a vulnerability in its Meraki MX and Z Series devices, affecting the Cisco AnyConnect VPN service and allowing unauthenticated remote attackers to trigger a denial-of-service (DoS) condition. Tracked as CVE-2025-20271, the flaw carries a CVSS score of 8.6, highlighting its high severity and disruptive potential for enterprise networks that rely on Meraki VPN gateways.
According to Cisco’s advisory:
“A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the Cisco AnyConnect service on an affected device.”
The flaw stems from variable initialization errors when establishing SSL VPN sessions with client certificate authentication enabled. An attacker can exploit this flaw by sending crafted HTTPS requests, triggering a crash and restart of the VPN service.
A successful attack causes all currently connected VPN users to be forcefully disconnected, requiring them to re-authenticate. Worse, if the attack is sustained:
“It could prevent new SSL VPN connections from being established, effectively making the Cisco AnyConnect VPN service unavailable for all legitimate users.”
This type of disruption is particularly impactful in hybrid and remote work environments, where organizations heavily rely on continuous VPN connectivity.
The vulnerability affects a wide range of Cisco Meraki MX and Z Series models running Cisco AnyConnect VPN with client certificate authentication enabled, including:
- MX Series: MX64, MX65, MX67, MX68, MX75, MX84, MX100, MX250, MX450, and others
- Z Series: Z3, Z3C, Z4, Z4C
- Virtual Appliance: vMX
Cisco provides a clear method to check device exposure:
- Log into the Cisco Meraki Dashboard
- Navigate to:
- Security & SD-WAN > Configure > Client VPN (for MX)
- Teleworker Gateway > Configure > Client VPN (for Z Series)
- Under AnyConnect Settings:
- If “Enabled” is selected, the device may be impacted
- In the Authentication & Policy section:
- If “Certificate authentication” is Enabled, the device is vulnerable
Cisco has released patches for affected versions:
| Firmware Branch | First Fixed Version |
|---|---|
| 18.1.x | 18.107.13 |
| 18.2.x | 18.211.6 |
| 19.1 | 19.1.8 |
Devices running firmware 16.2 or earlier are not affected.
Related Posts:
- Cisco Addresses High Severity Vulnerabilities in Enterprise Chat and Email, and Meraki MX/Z Series Devices
- Malicious Cisco AnyConnect Ads Target Users with NetSupport RAT
- Samsung Teases Galaxy Z Fold7 “Ultra”: AI, VR & Next-Gen Foldable Tech!
- Samsung Halts One UI 7 Rollout Due to Lockscreen Issues
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
