CVE-2024-20373
Vulnerability from cvelistv5
Published
2024-11-15 14:52
Modified
2024-11-15 16:20
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Cisco IOS and Cisco IOS XE SNMP Extended ACL Bypass Vulnerability
References
ykramarz@cisco.comhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-uwBXfqww
Impacted products
CiscoCisco IOS XE Catalyst SD-WAN
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.10.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.10.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.10.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.10.3a:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.10.3b:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.10.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.10.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.10.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.11.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.11.1a:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.11.1b:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.11.1d:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.11.1f:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.11.1s:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.12.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.12.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.12.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.12.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:cisco:ios_xe_catalyst_sd-wan:16.9.3:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ios_xe_catalyst_sd-wan",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "16.10.1"
              },
              {
                "status": "affected",
                "version": "16.10.2"
              },
              {
                "status": "affected",
                "version": "16.10.3"
              },
              {
                "status": "affected",
                "version": "16.10.3a"
              },
              {
                "status": "affected",
                "version": "16.10.3b"
              },
              {
                "status": "affected",
                "version": "16.10.4"
              },
              {
                "status": "affected",
                "version": "16.10.5"
              },
              {
                "status": "affected",
                "version": "16.10.6"
              },
              {
                "status": "affected",
                "version": "16.11.1"
              },
              {
                "status": "affected",
                "version": "16.11.1a"
              },
              {
                "status": "affected",
                "version": "16.11.1b"
              },
              {
                "status": "affected",
                "version": "16.11.1d"
              },
              {
                "status": "affected",
                "version": "16.11.1f"
              },
              {
                "status": "affected",
                "version": "16.11.1s"
              },
              {
                "status": "affected",
                "version": "16.12.1"
              },
              {
                "status": "affected",
                "version": "16.12.3"
              },
              {
                "status": "affected",
                "version": "16.12.4"
              },
              {
                "status": "affected",
                "version": "16.12.5"
              },
              {
                "status": "affected",
                "version": "16.9.3"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T16:20:19.710967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T16:20:59.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco IOS XE Catalyst SD-WAN",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "16.10.6"
            },
            {
              "status": "affected",
              "version": "16.12.3"
            },
            {
              "status": "affected",
              "version": "16.12.1"
            },
            {
              "status": "affected",
              "version": "16.10.4"
            },
            {
              "status": "affected",
              "version": "16.10.5"
            },
            {
              "status": "affected",
              "version": "16.12.4"
            },
            {
              "status": "affected",
              "version": "16.10.3"
            },
            {
              "status": "affected",
              "version": "16.10.3a"
            },
            {
              "status": "affected",
              "version": "16.10.3b"
            },
            {
              "status": "affected",
              "version": "16.11.1s"
            },
            {
              "status": "affected",
              "version": "16.11.1a"
            },
            {
              "status": "affected",
              "version": "16.10.1"
            },
            {
              "status": "affected",
              "version": "16.11.1f"
            },
            {
              "status": "affected",
              "version": "16.9.4"
            },
            {
              "status": "affected",
              "version": "16.9.3"
            },
            {
              "status": "affected",
              "version": "16.10.2"
            },
            {
              "status": "affected",
              "version": "16.11.1b"
            },
            {
              "status": "affected",
              "version": "16.11.1"
            },
            {
              "status": "affected",
              "version": "16.12.5"
            },
            {
              "status": "affected",
              "version": "16.11.1d"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) IPv4 access control list (ACL) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform SNMP polling of an affected device, even if it is configured to deny SNMP traffic.\u0026nbsp;\r\n\r\nThis vulnerability exists because Cisco IOS Software and Cisco IOS XE Software do not support extended IPv4 ACLs for SNMP, but they do allow administrators to configure extended named IPv4 ACLs that are attached to the SNMP server configuration without a warning message. This can result in no ACL being applied to the SNMP listening process. An attacker could exploit this vulnerability by performing SNMP polling of an affected device. A successful exploit could allow the attacker to perform SNMP operations that should be denied. The attacker has no control of the SNMP ACL configuration and would still need a valid SNMP version 2c (SNMPv2c) community string or SNMP version 3 (SNMPv3) user credentials.\r\nSNMP with IPv6 ACL configurations is not affected.\r\nFor more information, see the  section of this advisory."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Control",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-15T14:52:34.137Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-snmp-uwBXfqww",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-uwBXfqww"
        }
      ],
      "source": {
        "advisory": "cisco-sa-snmp-uwBXfqww",
        "defects": [
          "CSCwe24431"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco IOS and Cisco IOS XE SNMP Extended ACL Bypass Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20373",
    "datePublished": "2024-11-15T14:52:34.137Z",
    "dateReserved": "2023-11-08T15:08:07.654Z",
    "dateUpdated": "2024-11-15T16:20:59.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-20373\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2024-11-15T15:15:06.823\",\"lastModified\":\"2024-11-18T17:11:56.587\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) IPv4 access control list (ACL) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform SNMP polling of an affected device, even if it is configured to deny SNMP traffic.\u0026nbsp;\\r\\n\\r\\nThis vulnerability exists because Cisco IOS Software and Cisco IOS XE Software do not support extended IPv4 ACLs for SNMP, but they do allow administrators to configure extended named IPv4 ACLs that are attached to the SNMP server configuration without a warning message. This can result in no ACL being applied to the SNMP listening process. An attacker could exploit this vulnerability by performing SNMP polling of an affected device. A successful exploit could allow the attacker to perform SNMP operations that should be denied. The attacker has no control of the SNMP ACL configuration and would still need a valid SNMP version 2c (SNMPv2c) community string or SNMP version 3 (SNMPv3) user credentials.\\r\\nSNMP with IPv6 ACL configurations is not affected.\\r\\nFor more information, see the  section of this advisory.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la implementaci\u00f3n de la caracter\u00edstica de lista de control de acceso (ACL) IPv4 del Protocolo simple de administraci\u00f3n de redes (SNMP) de Cisco IOS Software y Cisco IOS XE Software podr\u00eda permitir que un atacante remoto no autenticado realice un sondeo SNMP de un dispositivo afectado, incluso si est\u00e1 configurado para denegar el tr\u00e1fico SNMP. Esta vulnerabilidad existe porque Cisco IOS Software y Cisco IOS XE Software no admiten ACL IPv4 extendidas para SNMP, pero s\u00ed permiten a los administradores configurar ACL IPv4 con nombre extendidas que se adjuntan a la configuraci\u00f3n del servidor SNMP sin un mensaje de advertencia. Esto puede provocar que no se aplique ninguna ACL al proceso de escucha SNMP. Un atacante podr\u00eda aprovechar esta vulnerabilidad realizando un sondeo SNMP de un dispositivo afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante realizar operaciones SNMP que deber\u00edan denegarse. El atacante no tiene control sobre la configuraci\u00f3n de la ACL de SNMP y a\u00fan necesitar\u00eda una cadena de comunidad de SNMP versi\u00f3n 2c (SNMPv2c) v\u00e1lida o credenciales de usuario de SNMP versi\u00f3n 3 (SNMPv3). SNMP con configuraciones de ACL de IPv6 no se ve afectado. Para obtener m\u00e1s informaci\u00f3n, consulte la secci\u00f3n de este aviso.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-uwBXfqww\",\"source\":\"ykramarz@cisco.com\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.