CVE-2024-20278
Vulnerability from cvelistv5
Published
2024-03-27 16:59
Modified
2024-08-15 16:45
Severity ?
EPSS score ?
Summary
A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XE Software |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T21:59:41.100Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-iosxe-priv-esc-seAx6NLX", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX" } ], "title": "CVE Program Container" }, { "affected": [ { "cpes": [ "cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1x:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1y:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1z:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.3a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1z1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.6:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.6a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.5a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1b:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.8.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.3a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1y1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ios_xe", "vendor": "cisco", "versions": [ { "status": "affected", "version": "17.6.1" }, { "status": "affected", "version": "17.6.2" }, { "status": "affected", "version": "17.6.1w" }, { "status": "affected", "version": "17.6.1a" }, { "status": "affected", "version": "17.6.1x" }, { "status": "affected", "version": "17.6.3" }, { "status": "affected", "version": "17.6.1y" }, { "status": "affected", "version": "17.6.1z" }, { "status": "affected", "version": "17.6.3a" }, { "status": "affected", "version": "17.6.4" }, { "status": "affected", "version": "17.6.1z1" }, { "status": "affected", "version": "17.6.5" }, { "status": "affected", "version": "17.6.6" }, { "status": "affected", "version": "17.6.6a" }, { "status": "affected", "version": "17.6.5a" }, { "status": "affected", "version": "17.7.1" }, { "status": "affected", "version": "17.7.1a" }, { "status": "affected", "version": "17.7.1b" }, { "status": "affected", "version": "17.7.2" }, { "status": "affected", "version": "17.10.1" }, { "status": "affected", "version": "17.10.1a" }, { "status": "affected", "version": "17.10.1b" }, { "status": "affected", "version": "17.8.1" }, { "status": "affected", "version": "17.8.1a" }, { "status": "affected", "version": "17.9.1" }, { "status": "affected", "version": "17.9.1w" }, { "status": "affected", "version": "17.9.2" }, { "status": "affected", "version": "17.9.1a" }, { "status": "affected", "version": "17.9.1x" }, { "status": "affected", "version": "17.9.1y" }, { "status": "affected", "version": "17.9.3" }, { "status": "affected", "version": "17.9.2a" }, { "status": "affected", "version": "17.9.1x1" }, { "status": "affected", "version": "17.9.3a" }, { "status": "affected", "version": "17.9.4" }, { "status": "affected", "version": "17.9.1y1" }, { "status": "affected", "version": "17.9.4a" }, { "status": "affected", "version": "17.11.1" }, { "status": "affected", "version": "17.11.1a" }, { "status": "affected", "version": "17.12.1" }, { "status": "affected", "version": "17.12.1w" }, { "status": "affected", "version": "17.12.1a" }, { "status": "affected", "version": "17.11.99sw" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-20278", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-03-28T04:00:40.599661Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-15T16:45:09.481Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Cisco IOS XE Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "17.6.1" }, { "status": "affected", "version": "17.6.2" }, { "status": "affected", "version": "17.6.1w" }, { "status": "affected", "version": "17.6.1a" }, { "status": "affected", "version": "17.6.1x" }, { "status": "affected", "version": "17.6.3" }, { "status": "affected", "version": "17.6.1y" }, { "status": "affected", "version": "17.6.1z" }, { "status": "affected", "version": "17.6.3a" }, { "status": "affected", "version": "17.6.4" }, { "status": "affected", "version": "17.6.1z1" }, { "status": "affected", "version": "17.6.5" }, { "status": "affected", "version": "17.6.6" }, { "status": "affected", "version": "17.6.6a" }, { "status": "affected", "version": "17.6.5a" }, { "status": "affected", "version": "17.7.1" }, { "status": "affected", "version": "17.7.1a" }, { "status": "affected", "version": "17.7.1b" }, { "status": "affected", "version": "17.7.2" }, { "status": "affected", "version": "17.10.1" }, { "status": "affected", "version": "17.10.1a" }, { "status": "affected", "version": "17.10.1b" }, { "status": "affected", "version": "17.8.1" }, { "status": "affected", "version": "17.8.1a" }, { "status": "affected", "version": "17.9.1" }, { "status": "affected", "version": "17.9.1w" }, { "status": "affected", "version": "17.9.2" }, { "status": "affected", "version": "17.9.1a" }, { "status": "affected", "version": "17.9.1x" }, { "status": "affected", "version": "17.9.1y" }, { "status": "affected", "version": "17.9.3" }, { "status": "affected", "version": "17.9.2a" }, { "status": "affected", "version": "17.9.1x1" }, { "status": "affected", "version": "17.9.3a" }, { "status": "affected", "version": "17.9.4" }, { "status": "affected", "version": "17.9.1y1" }, { "status": "affected", "version": "17.9.4a" }, { "status": "affected", "version": "17.11.1" }, { "status": "affected", "version": "17.11.1a" }, { "status": "affected", "version": "17.12.1" }, { "status": "affected", "version": "17.12.1w" }, { "status": "affected", "version": "17.12.1a" }, { "status": "affected", "version": "17.11.99SW" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\r\n\r This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root." } ], "exploits": [ { "lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-184", "description": "Incomplete List of Disallowed Inputs", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-27T16:59:12.963Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-iosxe-priv-esc-seAx6NLX", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX" } ], "source": { "advisory": "cisco-sa-iosxe-priv-esc-seAx6NLX", "defects": [ "CSCwf91143" ], "discovery": "INTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20278", "datePublished": "2024-03-27T16:59:12.963Z", "dateReserved": "2023-11-08T15:08:07.625Z", "dateUpdated": "2024-08-15T16:45:09.481Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-20278\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2024-03-27T17:15:51.703\",\"lastModified\":\"2024-03-27T17:48:21.140\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\\r\\n\\r This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la funci\u00f3n NETCONF del software Cisco IOS XE podr\u00eda permitir que un atacante remoto autenticado eleve los privilegios a root en un dispositivo afectado. Esta vulnerabilidad se debe a una validaci\u00f3n inadecuada de la entrada proporcionada por el usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando informaci\u00f3n manipulada a trav\u00e9s de NETCONF a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante elevar los privilegios de Administrador a Root.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.2,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-184\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX\",\"source\":\"ykramarz@cisco.com\"}]}}" } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.