New Cisco ASA and FTD features block VPN brute-force password attacks

Cisco reported large-scale brute-force and password-spray attacks against VPN services that exposed a DoS condition in ASA and FTD (CVE-2024-20481). Cisco released threat-detection features to mitigate repeated failed authentications, client-initiation attacks, and connections to internal tunnel-groups, including supported ASA/FTD versions and sample configuration commands to enable shunning of offending IPs; the report also notes operational considerations such as potential performance impact and manual removal of shunned addresses.