Cisco has disclosed a significant vulnerability in its AnyConnect VPN Server for Meraki MX and Z Series devices, allowing authenticated attackers to trigger denial-of-service (DoS) conditions.
The flaw (CVE-2025-20212) stems from an uninitialized variable during SSL VPN session establishment and affects over 20 hardware models across enterprise networks.
Vulnerability Overview
Exploiting this bug requires valid VPN credentials. Attackers can craft malicious attributes during session setup, forcing the VPN service to restart and disrupting active SSL VPN connections.
.png
)
Sustained attacks could block new VPN sessions entirely, though services resume automatically after malicious traffic stops.
Affected Products
| MX Series | Z Series |
| MX64, MX64W | Z3, Z3C |
| MX65, MX65W | Z4, Z4C |
| MX67, MX67C, MX67W | |
| MX68, MX68CW, MX68W | |
| MX75, MX84, MX85 | |
| MX95, MX100, MX105 | |
| MX250, MX400, MX450 | |
| MX600, vMX |
Mitigation Steps
- Verify AnyConnect VPN Status:
- Dashboard > Security & SD-WAN (MX) or Teleworker Gateway (Z Series) > Client VPN > AnyConnect Settings.
- Disabled configurations are not vulnerable.
- Update Firmware:
- MX/Z Series: Migrate to fixed versions (e.g., 18.107.12 for 18.1, 19.1.4 for 19.1).
- Critical: MX400/MX600 users must replace hardware or isolate vulnerable devices.
- Monitor Sessions:
- Watch for repeated VPN reconnections or unexplained service restarts.
Technical Analysis
- CWE-457: Uninitialized variable in SSL VPN session handling.
- Attack Vector: Network-based (AV:N) with low complexity (AC:L).
- Impact: High Availability risk (A:H) but no data compromise (C:N/I:N).
Fixed Releases
| Firmware Branch | First Fixed Version |
| 18.1 | 18.107.12 |
| 18.2 | 18.211.4 |
| 19.1 | 19.1.4 |
Cisco has confirmed that there are no workarounds for this issue, and only upgrading to a fixed release can resolve the vulnerability.
Administrators are advised to monitor their deployments carefully and upgrade affected Meraki devices promptly to ensure continued secure and reliable VPN functionality. Further details and firmware best practices can be found in Cisco’s official advisory.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
