Action not permitted
Modal body text goes here.
wid-sec-w-2024-0631
Vulnerability from csaf_certbund
Published
2024-03-13 23:00
Modified
2024-03-13 23:00
Summary
Cisco IOS XR: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Cisco Internetwork Operating System (IOS) ist ein Betriebssystem, das für Cisco Geräte wie z. B. Router und Switches eingesetzt wird.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen in Cisco IOS XR ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen oder seine Privilegien zu erweitern.
Betroffene Betriebssysteme
- CISCO Appliance
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Cisco Internetwork Operating System (IOS) ist ein Betriebssystem, das f\u00fcr Cisco Ger\u00e4te wie z. B. Router und Switches eingesetzt wird.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in Cisco IOS XR ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder seine Privilegien zu erweitern.", "title": "Angriff" }, { "category": "general", "text": "- CISCO Appliance", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0631 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0631.json" }, { "category": "self", "summary": "WID-SEC-2024-0631 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0631" }, { "category": "external", "summary": "Cisco Security Advisory vom 2024-03-13", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e" }, { "category": "external", "summary": "Cisco Security Advisory vom 2024-03-13", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dhcp-dos-3tgPKRdm" }, { "category": "external", "summary": "Cisco Security Advisory vom 2024-03-13", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW" }, { "category": "external", "summary": "Cisco Security Advisory vom 2024-03-13", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-dos-kb6sUUHw" }, { "category": "external", "summary": "Cisco Security Advisory vom 2024-03-13", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ssh-privesc-eWDMKew3" }, { "category": "external", "summary": "Cisco Security Advisory vom 2024-03-13", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-uhv6ZDeF" }, { "category": "external", "summary": "Cisco Security Advisory vom 2024-03-13", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrl2vpn-jesrU3fc" } ], "source_lang": "en-US", "title": "Cisco IOS XR: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-03-13T23:00:00.000+00:00", "generator": { "date": "2024-03-14T11:36:01.004+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0631", "initial_release_date": "2024-03-13T23:00:00.000+00:00", "revision_history": [ { "date": "2024-03-13T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c 7.9.2", "product": { "name": "Cisco IOS XR \u003c 7.9.2", "product_id": "T033474", "product_identification_helper": { "cpe": "cpe:/o:cisco:ios_xr:7.9.2" } } }, { "category": "product_version_range", "name": "\u003c 7.10.1", "product": { "name": "Cisco IOS XR \u003c 7.10.1", "product_id": "T033475", "product_identification_helper": { "cpe": "cpe:/o:cisco:ios_xr:7.10.1" } } }, { "category": "product_version_range", "name": "\u003c 24.1.1", "product": { "name": "Cisco IOS XR \u003c 24.1.1", "product_id": "T033476", "product_identification_helper": { "cpe": "cpe:/o:cisco:ios_xr:24.1.1" } } }, { "category": "product_version_range", "name": "\u003c 7.10.2", "product": { "name": "Cisco IOS XR \u003c 7.10.2", "product_id": "T033477", "product_identification_helper": { "cpe": "cpe:/o:cisco:ios_xr:7.10.2" } } }, { "category": "product_version_range", "name": "\u003c 7.11.1", "product": { "name": "Cisco IOS XR \u003c 7.11.1", "product_id": "T033478", "product_identification_helper": { "cpe": "cpe:/o:cisco:ios_xr:7.11.1" } } }, { "category": "product_version_range", "name": "\u003c 7.9.21", "product": { "name": "Cisco IOS XR \u003c 7.9.21", "product_id": "T033479", "product_identification_helper": { "cpe": "cpe:/o:cisco:ios_xr:7.9.21" } } }, { "category": "product_version_range", "name": "\u003c 7.11.2", "product": { "name": "Cisco IOS XR \u003c 7.11.2", "product_id": "T033481", "product_identification_helper": { "cpe": "cpe:/o:cisco:ios_xr:7.11.2" } } } ], "category": "product_name", "name": "IOS XR" } ], "category": "vendor", "name": "Cisco" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-20262", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Cisco IOS XR. Dieser Fehler besteht im Secure Copy Protocol (SCP) und der SFTP-Funktion aufgrund einer fehlenden Validierung der SCP- und SFTP-CLI-Eingabeparameter. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, indem er sich am Ger\u00e4t authentifiziert und SCP- oder SFTP-CLI-Befehle mit bestimmten Parametern ausgibt, um einen Denial-of-Service-Zustand zu verursachen." } ], "product_status": { "known_affected": [ "T033479", "T033477", "T033475", "T033474" ] }, "release_date": "2024-03-13T23:00:00Z", "title": "CVE-2024-20262" }, { "cve": "CVE-2024-20266", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Cisco IOS XR. Dieser Fehler besteht in der DHCP Version 4 (DHCPv4) Serverfunktion, da bestimmte DHCPv4-Meldungen bei der Verarbeitung nicht ordnungsgem\u00e4\u00df validiert werden. Durch das Senden einer fehlerhaften DHCPv4-Meldung an ein betroffenes Ger\u00e4t kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu verursachen." } ], "product_status": { "known_affected": [ "T033479", "T033477", "T033475", "T033474" ] }, "release_date": "2024-03-13T23:00:00Z", "title": "CVE-2024-20266" }, { "cve": "CVE-2024-20322", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Cisco IOS XR. Diese Fehler bestehen in der IP-Zugangskontrollliste (ACL) aufgrund einer unsachgem\u00e4\u00dfen Zuweisung von Nachschlageschl\u00fcsseln zu internen Schnittstellenkontexten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen." } ], "product_status": { "known_affected": [ "T033479", "T033478", "T033475", "T033474" ] }, "release_date": "2024-03-13T23:00:00Z", "title": "CVE-2024-20322" }, { "cve": "CVE-2024-20315", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Cisco IOS XR. Diese Fehler bestehen in der IP-Zugangskontrollliste (ACL) aufgrund einer unsachgem\u00e4\u00dfen Zuweisung von Nachschlageschl\u00fcsseln zu internen Schnittstellenkontexten. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen." } ], "product_status": { "known_affected": [ "T033479", "T033478", "T033475", "T033474" ] }, "release_date": "2024-03-13T23:00:00Z", "title": "CVE-2024-20315" }, { "cve": "CVE-2024-20318", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Cisco IOS XR. Dieser Fehler besteht in den Layer-2-Ethernet-Diensten aufgrund der falschen Behandlung bestimmter Ethernet-Frames. Ein benachbarter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu verursachen." } ], "release_date": "2024-03-13T23:00:00Z", "title": "CVE-2024-20318" }, { "cve": "CVE-2024-20319", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Cisco IOS XR. Dieser Fehler besteht im UDP-Weiterleitungscode aufgrund einer falschen UDP-Weiterleitungsprogrammierung bei der Verwendung von SNMP mit Management-Plane-Schutz. Durch den Versuch, einen SNMP-Vorgang mit Broadcast als Zieladresse durchzuf\u00fchren, kann ein benachbarter, anonymer Angreifer diese Schwachstelle ausnutzen, um konfigurierte Schutzrichtlinien f\u00fcr die Verwaltungsebene zu umgehen und auf den SNMP-Server (Simple Network Management Plane) zuzugreifen." } ], "product_status": { "known_affected": [ "T033479", "T033477", "T033478", "T033481", "T033475", "T033474" ] }, "release_date": "2024-03-13T23:00:00Z", "title": "CVE-2024-20319" }, { "cve": "CVE-2024-20320", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Cisco IOS XR. Dieser Fehler besteht in der SSH-Client-Funktion aufgrund einer unzureichenden Validierung von Argumenten, die im SSH-Client-CLI-Befehl enthalten sind. Durch die Ausgabe eines manipulierten SSH-Client-Befehls an die CLI kann ein lokaler Angreifer diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern." } ], "product_status": { "known_affected": [ "T033479", "T033475", "T033474" ] }, "release_date": "2024-03-13T23:00:00Z", "title": "CVE-2024-20320" }, { "cve": "CVE-2024-20327", "notes": [ { "category": "description", "text": "There is a vulnerability in Cisco IOS XR. This flaw exists in the PPP over Ethernet (PPPoE) termination feature due to the improper handling of malformed PPPoE packets. By sending a crafted PPPoE packet to an affected line card interface, an adjacent, anonymous attacker can exploit this vulnerability to cause a Denial of Service condition." } ], "product_status": { "known_affected": [ "T033474" ] }, "release_date": "2024-03-13T23:00:00Z", "title": "CVE-2024-20327" } ] }
cve-2024-20320
Vulnerability from cvelistv5
Published
2024-03-13 16:41
Modified
2024-08-16 18:53
Severity ?
EPSS score ?
Summary
A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series and 5700 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device.
This vulnerability is due to insufficient validation of arguments that are included with the SSH client CLI command. An attacker with low-privileged access to an affected device could exploit this vulnerability by issuing a crafted SSH client command to the CLI. A successful exploit could allow the attacker to elevate privileges to root on the affected device.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XR Software |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T21:59:42.846Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-iosxr-ssh-privesc-eWDMKew3", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ssh-privesc-eWDMKew3" } ], "title": "CVE Program Container" }, { "affected": [ { "cpes": [ "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ios_xr", "vendor": "cisco", "versions": [ { "status": "affected", "version": "7.2.1" }, { "status": "affected", "version": "7.2.2" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.15" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "7.7.21" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.9.21" }, { "status": "affected", "version": "7.10.1" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-20320", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-03-16T04:00:53.164644Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-16T18:53:02.009Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "7.2.1" }, { "status": "affected", "version": "7.2.2" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.15" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "7.7.21" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.9.21" }, { "status": "affected", "version": "7.10.1" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series and 5700 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. \r\n\r This vulnerability is due to insufficient validation of arguments that are included with the SSH client CLI command. An attacker with low-privileged access to an affected device could exploit this vulnerability by issuing a crafted SSH client command to the CLI. A successful exploit could allow the attacker to elevate privileges to root on the affected device." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-266", "description": "Incorrect Privilege Assignment", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-13T16:41:52.488Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-iosxr-ssh-privesc-eWDMKew3", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ssh-privesc-eWDMKew3" } ], "source": { "advisory": "cisco-sa-iosxr-ssh-privesc-eWDMKew3", "defects": [ "CSCwh52374" ], "discovery": "INTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20320", "datePublished": "2024-03-13T16:41:52.488Z", "dateReserved": "2023-11-08T15:08:07.632Z", "dateUpdated": "2024-08-16T18:53:02.009Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-20262
Vulnerability from cvelistv5
Published
2024-03-13 16:46
Modified
2024-08-01 21:52
Severity ?
EPSS score ?
Summary
A vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to create or overwrite files in a system directory, which could lead to a denial of service (DoS) condition. The attacker would require valid user credentials to perform this attack.
This vulnerability is due to a lack of proper validation of SCP and SFTP CLI input parameters. An attacker could exploit this vulnerability by authenticating to the device and issuing SCP or SFTP CLI commands with specific parameters. A successful exploit could allow the attacker to impact the functionality of the device, which could lead to a DoS condition. The device may need to be manually rebooted to recover.
Note: This vulnerability is exploitable only when a local user invokes SCP or SFTP commands at the Cisco IOS XR CLI. A local user with administrative privileges could exploit this vulnerability remotely.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XR Software |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-20262", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-03-13T18:40:03.905095Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:40:27.162Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T21:52:31.788Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-iosxr-scp-dos-kb6sUUHw", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-dos-kb6sUUHw" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "5.2.0" }, { "status": "affected", "version": "5.2.1" }, { "status": "affected", "version": "5.2.2" }, { "status": "affected", "version": "5.2.4" }, { "status": "affected", "version": "5.2.3" }, { "status": "affected", "version": "5.2.5" }, { "status": "affected", "version": "5.2.47" }, { "status": "affected", "version": "5.3.0" }, { "status": "affected", "version": "5.3.1" }, { "status": "affected", "version": "5.3.2" }, { "status": "affected", "version": "5.3.3" }, { "status": "affected", "version": "5.3.4" }, { "status": "affected", "version": "6.0.0" }, { "status": "affected", "version": "6.0.1" }, { "status": "affected", "version": "6.0.2" }, { "status": "affected", "version": "6.1.1" }, { "status": "affected", "version": "6.1.2" }, { "status": "affected", "version": "6.1.3" }, { "status": "affected", "version": "6.1.4" }, { "status": "affected", "version": "6.1.12" }, { "status": "affected", "version": "6.1.22" }, { "status": "affected", "version": "6.1.32" }, { "status": "affected", "version": "6.1.36" }, { "status": "affected", "version": "6.1.42" }, { "status": "affected", "version": "6.2.1" }, { "status": "affected", "version": "6.2.2" }, { "status": "affected", "version": "6.2.3" }, { "status": "affected", "version": "6.2.25" }, { "status": "affected", "version": "6.2.11" }, { "status": "affected", "version": "6.3.2" }, { "status": "affected", "version": "6.3.3" }, { "status": "affected", "version": "6.3.15" }, { "status": "affected", "version": "6.4.1" }, { "status": "affected", "version": "6.4.2" }, { "status": "affected", "version": "6.4.3" }, { "status": "affected", "version": "6.5.1" }, { "status": "affected", "version": "6.5.2" }, { "status": "affected", "version": "6.5.3" }, { "status": "affected", "version": "6.5.25" }, { "status": "affected", "version": "6.5.26" }, { "status": "affected", "version": "6.5.28" }, { "status": "affected", "version": "6.5.29" }, { "status": "affected", "version": "6.5.32" }, { "status": "affected", "version": "6.5.33" }, { "status": "affected", "version": "6.6.2" }, { "status": "affected", "version": "6.6.3" }, { "status": "affected", "version": "6.6.25" }, { "status": "affected", "version": "6.6.4" }, { "status": "affected", "version": "7.0.1" }, { "status": "affected", "version": "7.0.2" }, { "status": "affected", "version": "7.0.12" }, { "status": "affected", "version": "7.0.14" }, { "status": "affected", "version": "7.1.1" }, { "status": "affected", "version": "7.1.2" }, { "status": "affected", "version": "6.7.2" }, { "status": "affected", "version": "6.7.4" }, { "status": "affected", "version": "7.2.0" }, { "status": "affected", "version": "7.2.1" }, { "status": "affected", "version": "7.2.2" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.15" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "7.7.21" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.10.1" }, { "status": "affected", "version": "7.10.2" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to create or overwrite files in a system directory, which could lead to a denial of service (DoS) condition. The attacker would require valid user credentials to perform this attack.\r\n\r This vulnerability is due to a lack of proper validation of SCP and SFTP CLI input parameters. An attacker could exploit this vulnerability by authenticating to the device and issuing SCP or SFTP CLI commands with specific parameters. A successful exploit could allow the attacker to impact the functionality of the device, which could lead to a DoS condition. The device may need to be manually rebooted to recover.\r\n\r Note: This vulnerability is exploitable only when a local user invokes SCP or SFTP commands at the Cisco IOS XR CLI. A local user with administrative privileges could exploit this vulnerability remotely." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "Improper Privilege Management", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-13T16:46:45.467Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-iosxr-scp-dos-kb6sUUHw", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-dos-kb6sUUHw" } ], "source": { "advisory": "cisco-sa-iosxr-scp-dos-kb6sUUHw", "defects": [ "CSCwf11720" ], "discovery": "INTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20262", "datePublished": "2024-03-13T16:46:45.467Z", "dateReserved": "2023-11-08T15:08:07.623Z", "dateUpdated": "2024-08-01T21:52:31.788Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-20322
Vulnerability from cvelistv5
Published
2024-03-13 16:43
Modified
2024-08-02 19:49
Severity ?
EPSS score ?
Summary
A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.
This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XR Software |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T21:59:41.959Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-iosxr-acl-bypass-RZU5NL3e", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e" } ], "title": "CVE Program Container" }, { "affected": [ { "cpes": [ "cpe:2.3:a:cisco:ios_xr_software:7.10.2:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ios_xr_software", "vendor": "cisco", "versions": [ { "status": "affected", "version": "7.10.2" } ] }, { "cpes": [ "cpe:2.3:a:cisco:ios_xr_software:7.11.1:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ios_xr_software", "vendor": "cisco", "versions": [ { "status": "affected", "version": "7.11.1" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-20322", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-02T19:47:43.541856Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-02T19:49:57.842Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "7.10.2" }, { "status": "affected", "version": "7.11.1" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.\r\n\r This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "Improper Access Control", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-13T16:43:53.196Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-iosxr-acl-bypass-RZU5NL3e", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e" } ], "source": { "advisory": "cisco-sa-iosxr-acl-bypass-RZU5NL3e", "defects": [ "CSCwh77265" ], "discovery": "INTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20322", "datePublished": "2024-03-13T16:43:53.196Z", "dateReserved": "2023-11-08T15:08:07.640Z", "dateUpdated": "2024-08-02T19:49:57.842Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-20266
Vulnerability from cvelistv5
Published
2024-03-13 16:42
Modified
2024-08-14 15:00
Severity ?
EPSS score ?
Summary
A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition.
This vulnerability exists because certain DHCPv4 messages are improperly validated when they are processed by an affected device. An attacker could exploit this vulnerability by sending a malformed DHCPv4 message to an affected device. A successful exploit could allow the attacker to cause a crash of the dhcpd process. While the dhcpd process is restarting, which may take approximately two minutes, DHCPv4 server services are unavailable on the affected device. This could temporarily prevent network access to clients that join the network during that time period and rely on the DHCPv4 server of the affected device.
Notes:
Only the dhcpd process crashes and eventually restarts automatically. The router does not reload.
This vulnerability only applies to DHCPv4. DHCP version 6 (DHCPv6) is not affected.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XR Software |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T21:52:31.683Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-iosxr-dhcp-dos-3tgPKRdm", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dhcp-dos-3tgPKRdm" } ], "title": "CVE Program Container" }, { "affected": [ { "cpes": [ "cpe:2.3:o:cisco:ios_xr:5.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.47:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.0:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.12:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.22:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.32:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.36:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.42:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.25:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.3.15:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.25:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.26:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.28:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.29:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.32:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.33:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.6.25:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.1.15:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.1.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.7.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.7.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.7.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.7.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.15:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.8.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.8.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.7.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.7.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.7.21:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.9.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.9.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.8.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.8.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.9.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.9.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.9.21:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.10.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.10.2:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ios_xr_software", "vendor": "cisco", "versions": [ { "status": "affected", "version": "5.2.0" }, { "status": "affected", "version": "5.2.1" }, { "status": "affected", "version": "5.2.2" }, { "status": "affected", "version": "5.2.4" }, { "status": "affected", "version": "5.2.3" }, { "status": "affected", "version": "5.2.5" }, { "status": "affected", "version": "5.2.47" }, { "status": "affected", "version": "5.3.0" }, { "status": "affected", "version": "5.3.1" }, { "status": "affected", "version": "5.3.2" }, { "status": "affected", "version": "5.3.3" }, { "status": "affected", "version": "5.3.4" }, { "status": "affected", "version": "6.0.0" }, { "status": "affected", "version": "6.0.1" }, { "status": "affected", "version": "6.0.2" }, { "status": "affected", "version": "6.1.1" }, { "status": "affected", "version": "6.1.2" }, { "status": "affected", "version": "6.1.3" }, { "status": "affected", "version": "6.1.4" }, { "status": "affected", "version": "6.1.12" }, { "status": "affected", "version": "6.1.22" }, { "status": "affected", "version": "6.1.32" }, { "status": "affected", "version": "6.1.36" }, { "status": "affected", "version": "6.1.42" }, { "status": "affected", "version": "6.2.1" }, { "status": "affected", "version": "6.2.2" }, { "status": "affected", "version": "6.2.3" }, { "status": "affected", "version": "6.2.25" }, { "status": "affected", "version": "6.2.11" }, { "status": "affected", "version": "6.3.2" }, { "status": "affected", "version": "6.3.3" }, { "status": "affected", "version": "6.3.15" }, { "status": "affected", "version": "6.4.1" }, { "status": "affected", "version": "6.4.2" }, { "status": "affected", "version": "6.4.3" }, { "status": "affected", "version": "6.5.1" }, { "status": "affected", "version": "6.5.2" }, { "status": "affected", "version": "6.5.3" }, { "status": "affected", "version": "6.5.25" }, { "status": "affected", "version": "6.5.26" }, { "status": "affected", "version": "6.5.28" }, { "status": "affected", "version": "6.5.29" }, { "status": "affected", "version": "6.5.32" }, { "status": "affected", "version": "6.5.33" }, { "status": "affected", "version": "6.6.2" }, { "status": "affected", "version": "6.6.3" }, { "status": "affected", "version": "6.6.25" }, { "status": "affected", "version": "6.6.4" }, { "status": "affected", "version": "7.0.1" }, { "status": "affected", "version": "7.0.2" }, { "status": "affected", "version": "7.0.12" }, { "status": "affected", "version": "7.0.14" }, { "status": "affected", "version": "7.1.1" }, { "status": "affected", "version": "7.1.15" }, { "status": "affected", "version": "7.1.2" }, { "status": "affected", "version": "7.1.3" }, { "status": "affected", "version": "6.7.1" }, { "status": "affected", "version": "6.7.2" }, { "status": "affected", "version": "6.7.3" }, { "status": "affected", "version": "6.7.4" }, { "status": "affected", "version": "7.2.0" }, { "status": "affected", "version": "7.2.1" }, { "status": "affected", "version": "7.2.2" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.15" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "6.8.1" }, { "status": "affected", "version": "6.8.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "7.7.21" }, { "status": "affected", "version": "6.9.1" }, { "status": "affected", "version": "6.9.2" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.9.21" }, { "status": "affected", "version": "7.10.1" }, { "status": "affected", "version": "7.10.2" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-20266", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-14T15:00:29.877058Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-14T15:00:38.372Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "5.2.0" }, { "status": "affected", "version": "5.2.1" }, { "status": "affected", "version": "5.2.2" }, { "status": "affected", "version": "5.2.4" }, { "status": "affected", "version": "5.2.3" }, { "status": "affected", "version": "5.2.5" }, { "status": "affected", "version": "5.2.47" }, { "status": "affected", "version": "5.3.0" }, { "status": "affected", "version": "5.3.1" }, { "status": "affected", "version": "5.3.2" }, { "status": "affected", "version": "5.3.3" }, { "status": "affected", "version": "5.3.4" }, { "status": "affected", "version": "6.0.0" }, { "status": "affected", "version": "6.0.1" }, { "status": "affected", "version": "6.0.2" }, { "status": "affected", "version": "6.1.1" }, { "status": "affected", "version": "6.1.2" }, { "status": "affected", "version": "6.1.3" }, { "status": "affected", "version": "6.1.4" }, { "status": "affected", "version": "6.1.12" }, { "status": "affected", "version": "6.1.22" }, { "status": "affected", "version": "6.1.32" }, { "status": "affected", "version": "6.1.36" }, { "status": "affected", "version": "6.1.42" }, { "status": "affected", "version": "6.2.1" }, { "status": "affected", "version": "6.2.2" }, { "status": "affected", "version": "6.2.3" }, { "status": "affected", "version": "6.2.25" }, { "status": "affected", "version": "6.2.11" }, { "status": "affected", "version": "6.3.2" }, { "status": "affected", "version": "6.3.3" }, { "status": "affected", "version": "6.3.15" }, { "status": "affected", "version": "6.4.1" }, { "status": "affected", "version": "6.4.2" }, { "status": "affected", "version": "6.4.3" }, { "status": "affected", "version": "6.5.1" }, { "status": "affected", "version": "6.5.2" }, { "status": "affected", "version": "6.5.3" }, { "status": "affected", "version": "6.5.25" }, { "status": "affected", "version": "6.5.26" }, { "status": "affected", "version": "6.5.28" }, { "status": "affected", "version": "6.5.29" }, { "status": "affected", "version": "6.5.32" }, { "status": "affected", "version": "6.5.33" }, { "status": "affected", "version": "6.6.2" }, { "status": "affected", "version": "6.6.3" }, { "status": "affected", "version": "6.6.25" }, { "status": "affected", "version": "6.6.4" }, { "status": "affected", "version": "7.0.1" }, { "status": "affected", "version": "7.0.2" }, { "status": "affected", "version": "7.0.12" }, { "status": "affected", "version": "7.0.14" }, { "status": "affected", "version": "7.1.1" }, { "status": "affected", "version": "7.1.15" }, { "status": "affected", "version": "7.1.2" }, { "status": "affected", "version": "7.1.3" }, { "status": "affected", "version": "6.7.1" }, { "status": "affected", "version": "6.7.2" }, { "status": "affected", "version": "6.7.3" }, { "status": "affected", "version": "6.7.4" }, { "status": "affected", "version": "7.2.0" }, { "status": "affected", "version": "7.2.1" }, { "status": "affected", "version": "7.2.2" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.15" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "6.8.1" }, { "status": "affected", "version": "6.8.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "7.7.21" }, { "status": "affected", "version": "6.9.1" }, { "status": "affected", "version": "6.9.2" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.9.21" }, { "status": "affected", "version": "7.10.1" }, { "status": "affected", "version": "7.10.2" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition.\r\n\r This vulnerability exists because certain DHCPv4 messages are improperly validated when they are processed by an affected device. An attacker could exploit this vulnerability by sending a malformed DHCPv4 message to an affected device. A successful exploit could allow the attacker to cause a crash of the dhcpd process. While the dhcpd process is restarting, which may take approximately two minutes, DHCPv4 server services are unavailable on the affected device. This could temporarily prevent network access to clients that join the network during that time period and rely on the DHCPv4 server of the affected device.\r\n\r Notes: \r\n\r \r Only the dhcpd process crashes and eventually restarts automatically. The router does not reload.\r This vulnerability only applies to DHCPv4. DHCP version 6 (DHCPv6) is not affected." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-476", "description": "NULL Pointer Dereference", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-13T16:42:27.815Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-iosxr-dhcp-dos-3tgPKRdm", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dhcp-dos-3tgPKRdm" } ], "source": { "advisory": "cisco-sa-iosxr-dhcp-dos-3tgPKRdm", "defects": [ "CSCwf83090" ], "discovery": "INTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20266", "datePublished": "2024-03-13T16:42:27.815Z", "dateReserved": "2023-11-08T15:08:07.624Z", "dateUpdated": "2024-08-14T15:00:38.372Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-20319
Vulnerability from cvelistv5
Published
2024-03-13 16:47
Modified
2024-08-01 21:59
Severity ?
EPSS score ?
Summary
A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and access the Simple Network Management Plane (SNMP) server of an affected device.
This vulnerability is due to incorrect UDP forwarding programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by attempting to perform an SNMP operation using broadcast as the destination address that could be processed by an affected device that is configured with an SNMP server. A successful exploit could allow the attacker to communicate to the device on the configured SNMP ports. Although an unauthenticated attacker could send UDP datagrams to the configured SNMP port, only an authenticated user can retrieve or modify data using SNMP requests.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XR Software |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:cisco:ios_xr:5.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.2.47:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.0:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:5.3.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.12:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.22:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.32:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.36:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.1.42:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.25:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.3.15:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.25:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.26:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.28:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.29:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.32:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.5.33:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.6.25:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.1.15:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.1.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.7.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.7.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.7.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.7.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.15:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.3.6:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.8.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.8.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.5.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.7.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.7.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.7.21:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.9.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:6.9.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.8.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.8.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.9.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.9.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.9.21:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.10.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.10.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xr:7.11.1:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ios_xr", "vendor": "cisco", "versions": [ { "status": "affected", "version": "5.2.0" }, { "status": "affected", "version": "5.2.1" }, { "status": "affected", "version": "5.2.2" }, { "status": "affected", "version": "5.2.4" }, { "status": "affected", "version": "5.2.3" }, { "status": "affected", "version": "5.2.5" }, { "status": "affected", "version": "5.2.47" }, { "status": "affected", "version": "5.3.0" }, { "status": "affected", "version": "5.3.1" }, { "status": "affected", "version": "5.3.2" }, { "status": "affected", "version": "5.3.3" }, { "status": "affected", "version": "5.3.4" }, { "status": "affected", "version": "6.0.0" }, { "status": "affected", "version": "6.0.1" }, { "status": "affected", "version": "6.0.2" }, { "status": "affected", "version": "6.1.1" }, { "status": "affected", "version": "6.1.2" }, { "status": "affected", "version": "6.1.3" }, { "status": "affected", "version": "6.1.4" }, { "status": "affected", "version": "6.1.12" }, { "status": "affected", "version": "6.1.22" }, { "status": "affected", "version": "6.1.32" }, { "status": "affected", "version": "6.1.36" }, { "status": "affected", "version": "6.1.42" }, { "status": "affected", "version": "6.2.1" }, { "status": "affected", "version": "6.2.2" }, { "status": "affected", "version": "6.2.3" }, { "status": "affected", "version": "6.2.25" }, { "status": "affected", "version": "6.2.11" }, { "status": "affected", "version": "6.3.2" }, { "status": "affected", "version": "6.3.3" }, { "status": "affected", "version": "6.3.15" }, { "status": "affected", "version": "6.4.1" }, { "status": "affected", "version": "6.4.2" }, { "status": "affected", "version": "6.4.3" }, { "status": "affected", "version": "6.5.1" }, { "status": "affected", "version": "6.5.2" }, { "status": "affected", "version": "6.5.3" }, { "status": "affected", "version": "6.5.25" }, { "status": "affected", "version": "6.5.26" }, { "status": "affected", "version": "6.5.28" }, { "status": "affected", "version": "6.5.29" }, { "status": "affected", "version": "6.5.32" }, { "status": "affected", "version": "6.5.33" }, { "status": "affected", "version": "6.6.2" }, { "status": "affected", "version": "6.6.3" }, { "status": "affected", "version": "6.6.25" }, { "status": "affected", "version": "6.6.4" }, { "status": "affected", "version": "7.0.1" }, { "status": "affected", "version": "7.0.2" }, { "status": "affected", "version": "7.0.12" }, { "status": "affected", "version": "7.0.14" }, { "status": "affected", "version": "7.1.1" }, { "status": "affected", "version": "7.1.15" }, { "status": "affected", "version": "7.1.2" }, { "status": "affected", "version": "7.1.3" }, { "status": "affected", "version": "6.7.1" }, { "status": "affected", "version": "6.7.2" }, { "status": "affected", "version": "6.7.3" }, { "status": "affected", "version": "6.7.4" }, { "status": "affected", "version": "7.2.0" }, { "status": "affected", "version": "7.2.1" }, { "status": "affected", "version": "7.2.2" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.15" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.3.6" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "6.8.1" }, { "status": "affected", "version": "6.8.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "7.7.21" }, { "status": "affected", "version": "6.9.1" }, { "status": "affected", "version": "6.9.2" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.9.21" }, { "status": "affected", "version": "7.10.1" }, { "status": "affected", "version": "7.10.2" }, { "status": "affected", "version": "7.11.1" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-20319", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-03-13T18:12:01.807199Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-02T16:26:46.466Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T21:59:41.556Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-snmp-uhv6ZDeF", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-uhv6ZDeF" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "5.2.0" }, { "status": "affected", "version": "5.2.1" }, { "status": "affected", "version": "5.2.2" }, { "status": "affected", "version": "5.2.4" }, { "status": "affected", "version": "5.2.3" }, { "status": "affected", "version": "5.2.5" }, { "status": "affected", "version": "5.2.47" }, { "status": "affected", "version": "5.3.0" }, { "status": "affected", "version": "5.3.1" }, { "status": "affected", "version": "5.3.2" }, { "status": "affected", "version": "5.3.3" }, { "status": "affected", "version": "5.3.4" }, { "status": "affected", "version": "6.0.0" }, { "status": "affected", "version": "6.0.1" }, { "status": "affected", "version": "6.0.2" }, { "status": "affected", "version": "6.1.1" }, { "status": "affected", "version": "6.1.2" }, { "status": "affected", "version": "6.1.3" }, { "status": "affected", "version": "6.1.4" }, { "status": "affected", "version": "6.1.12" }, { "status": "affected", "version": "6.1.22" }, { "status": "affected", "version": "6.1.32" }, { "status": "affected", "version": "6.1.36" }, { "status": "affected", "version": "6.1.42" }, { "status": "affected", "version": "6.2.1" }, { "status": "affected", "version": "6.2.2" }, { "status": "affected", "version": "6.2.3" }, { "status": "affected", "version": "6.2.25" }, { "status": "affected", "version": "6.2.11" }, { "status": "affected", "version": "6.3.2" }, { "status": "affected", "version": "6.3.3" }, { "status": "affected", "version": "6.3.15" }, { "status": "affected", "version": "6.4.1" }, { "status": "affected", "version": "6.4.2" }, { "status": "affected", "version": "6.4.3" }, { "status": "affected", "version": "6.5.1" }, { "status": "affected", "version": "6.5.2" }, { "status": "affected", "version": "6.5.3" }, { "status": "affected", "version": "6.5.25" }, { "status": "affected", "version": "6.5.26" }, { "status": "affected", "version": "6.5.28" }, { "status": "affected", "version": "6.5.29" }, { "status": "affected", "version": "6.5.32" }, { "status": "affected", "version": "6.5.33" }, { "status": "affected", "version": "6.6.2" }, { "status": "affected", "version": "6.6.3" }, { "status": "affected", "version": "6.6.25" }, { "status": "affected", "version": "6.6.4" }, { "status": "affected", "version": "7.0.1" }, { "status": "affected", "version": "7.0.2" }, { "status": "affected", "version": "7.0.12" }, { "status": "affected", "version": "7.0.14" }, { "status": "affected", "version": "7.1.1" }, { "status": "affected", "version": "7.1.15" }, { "status": "affected", "version": "7.1.2" }, { "status": "affected", "version": "7.1.3" }, { "status": "affected", "version": "6.7.1" }, { "status": "affected", "version": "6.7.2" }, { "status": "affected", "version": "6.7.3" }, { "status": "affected", "version": "6.7.4" }, { "status": "affected", "version": "7.2.0" }, { "status": "affected", "version": "7.2.1" }, { "status": "affected", "version": "7.2.2" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.15" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.3.6" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "6.8.1" }, { "status": "affected", "version": "6.8.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "7.7.21" }, { "status": "affected", "version": "6.9.1" }, { "status": "affected", "version": "6.9.2" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.9.21" }, { "status": "affected", "version": "7.10.1" }, { "status": "affected", "version": "7.10.2" }, { "status": "affected", "version": "7.11.1" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and access the Simple Network Management Plane (SNMP) server of an affected device.\r\n\r This vulnerability is due to incorrect UDP forwarding programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by attempting to perform an SNMP operation using broadcast as the destination address that could be processed by an affected device that is configured with an SNMP server. A successful exploit could allow the attacker to communicate to the device on the configured SNMP ports. Although an unauthenticated attacker could send UDP datagrams to the configured SNMP port, only an authenticated user can retrieve or modify data using SNMP requests." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "Improper Access Control", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-13T16:47:09.543Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-snmp-uhv6ZDeF", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-uhv6ZDeF" } ], "source": { "advisory": "cisco-sa-snmp-uhv6ZDeF", "defects": [ "CSCwh31469" ], "discovery": "EXTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20319", "datePublished": "2024-03-13T16:47:09.543Z", "dateReserved": "2023-11-08T15:08:07.632Z", "dateUpdated": "2024-08-01T21:59:41.556Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-20327
Vulnerability from cvelistv5
Published
2024-03-13 16:40
Modified
2024-08-01 21:59
Severity ?
EPSS score ?
Summary
A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service (DoS) condition.
This vulnerability is due to the improper handling of malformed PPPoE packets that are received on a router that is running Broadband Network Gateway (BNG) functionality with PPPoE termination on a Lightspeed-based or Lightspeed-Plus-based line card. An attacker could exploit this vulnerability by sending a crafted PPPoE packet to an affected line card interface that does not terminate PPPoE. A successful exploit could allow the attacker to crash the ppp_ma process, resulting in a DoS condition for PPPoE traffic across the router.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XR Software |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-20327", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-03-15T15:19:29.765453Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:40:27.563Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T21:59:42.888Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-iosxr-pppma-JKWFgneW", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "5.2.0" }, { "status": "affected", "version": "5.2.2" }, { "status": "affected", "version": "5.2.4" }, { "status": "affected", "version": "5.3.0" }, { "status": "affected", "version": "5.3.1" }, { "status": "affected", "version": "5.3.2" }, { "status": "affected", "version": "5.3.3" }, { "status": "affected", "version": "5.3.4" }, { "status": "affected", "version": "6.0.0" }, { "status": "affected", "version": "6.0.1" }, { "status": "affected", "version": "6.0.2" }, { "status": "affected", "version": "6.1.1" }, { "status": "affected", "version": "6.1.2" }, { "status": "affected", "version": "6.1.3" }, { "status": "affected", "version": "6.1.4" }, { "status": "affected", "version": "6.2.1" }, { "status": "affected", "version": "6.2.2" }, { "status": "affected", "version": "6.2.3" }, { "status": "affected", "version": "6.2.25" }, { "status": "affected", "version": "6.3.2" }, { "status": "affected", "version": "6.3.3" }, { "status": "affected", "version": "6.4.1" }, { "status": "affected", "version": "6.4.2" }, { "status": "affected", "version": "6.5.1" }, { "status": "affected", "version": "6.5.2" }, { "status": "affected", "version": "6.5.3" }, { "status": "affected", "version": "6.6.2" }, { "status": "affected", "version": "6.6.3" }, { "status": "affected", "version": "6.6.25" }, { "status": "affected", "version": "7.0.1" }, { "status": "affected", "version": "7.0.2" }, { "status": "affected", "version": "7.1.1" }, { "status": "affected", "version": "7.1.15" }, { "status": "affected", "version": "7.1.2" }, { "status": "affected", "version": "7.1.3" }, { "status": "affected", "version": "6.7.1" }, { "status": "affected", "version": "6.7.2" }, { "status": "affected", "version": "6.7.3" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "6.8.1" }, { "status": "affected", "version": "6.8.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "6.9.1" }, { "status": "affected", "version": "6.9.2" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service (DoS) condition.\r\n\r This vulnerability is due to the improper handling of malformed PPPoE packets that are received on a router that is running Broadband Network Gateway (BNG) functionality with PPPoE termination on a Lightspeed-based or Lightspeed-Plus-based line card. An attacker could exploit this vulnerability by sending a crafted PPPoE packet to an affected line card interface that does not terminate PPPoE. A successful exploit could allow the attacker to crash the ppp_ma process, resulting in a DoS condition for PPPoE traffic across the router." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "Improper Input Validation", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-13T16:40:38.336Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-iosxr-pppma-JKWFgneW", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW" } ], "source": { "advisory": "cisco-sa-iosxr-pppma-JKWFgneW", "defects": [ "CSCwf75789" ], "discovery": "INTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20327", "datePublished": "2024-03-13T16:40:38.336Z", "dateReserved": "2023-11-08T15:08:07.641Z", "dateUpdated": "2024-08-01T21:59:42.888Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-20318
Vulnerability from cvelistv5
Published
2024-03-13 16:46
Modified
2024-08-01 21:59
Severity ?
EPSS score ?
Summary
A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the line card network processor to reset, resulting in a denial of service (DoS) condition.
This vulnerability is due to the incorrect handling of specific Ethernet frames that are received on line cards that have the Layer 2 services feature enabled. An attacker could exploit this vulnerability by sending specific Ethernet frames through an affected device. A successful exploit could allow the attacker to cause the ingress interface network processor to reset, resulting in a loss of traffic over the interfaces that are supported by the network processor. Multiple resets of the network processor would cause the line card to reset, resulting in a DoS condition.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XR Software |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-20318", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-03-13T18:14:49.794916Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-05T17:22:18.112Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T21:59:41.382Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-xrl2vpn-jesrU3fc", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrl2vpn-jesrU3fc" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "6.5.2" }, { "status": "affected", "version": "6.5.3" }, { "status": "affected", "version": "6.6.2" }, { "status": "affected", "version": "6.6.3" }, { "status": "affected", "version": "6.6.25" }, { "status": "affected", "version": "7.0.1" }, { "status": "affected", "version": "7.0.2" }, { "status": "affected", "version": "7.1.1" }, { "status": "affected", "version": "7.1.15" }, { "status": "affected", "version": "7.1.2" }, { "status": "affected", "version": "7.1.3" }, { "status": "affected", "version": "6.7.1" }, { "status": "affected", "version": "6.7.2" }, { "status": "affected", "version": "6.7.3" }, { "status": "affected", "version": "7.3.1" }, { "status": "affected", "version": "7.3.2" }, { "status": "affected", "version": "7.3.3" }, { "status": "affected", "version": "7.3.5" }, { "status": "affected", "version": "7.4.1" }, { "status": "affected", "version": "7.4.2" }, { "status": "affected", "version": "6.8.1" }, { "status": "affected", "version": "6.8.2" }, { "status": "affected", "version": "7.5.1" }, { "status": "affected", "version": "7.5.3" }, { "status": "affected", "version": "7.5.2" }, { "status": "affected", "version": "7.5.4" }, { "status": "affected", "version": "7.5.5" }, { "status": "affected", "version": "7.6.1" }, { "status": "affected", "version": "7.6.2" }, { "status": "affected", "version": "7.7.1" }, { "status": "affected", "version": "7.7.2" }, { "status": "affected", "version": "6.9.1" }, { "status": "affected", "version": "6.9.2" }, { "status": "affected", "version": "7.8.1" }, { "status": "affected", "version": "7.8.2" }, { "status": "affected", "version": "7.9.1" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the line card network processor to reset, resulting in a denial of service (DoS) condition.\r\n\r This vulnerability is due to the incorrect handling of specific Ethernet frames that are received on line cards that have the Layer 2 services feature enabled. An attacker could exploit this vulnerability by sending specific Ethernet frames through an affected device. A successful exploit could allow the attacker to cause the ingress interface network processor to reset, resulting in a loss of traffic over the interfaces that are supported by the network processor. Multiple resets of the network processor would cause the line card to reset, resulting in a DoS condition." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "Improper Input Validation", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-13T16:46:24.113Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-xrl2vpn-jesrU3fc", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrl2vpn-jesrU3fc" } ], "source": { "advisory": "cisco-sa-xrl2vpn-jesrU3fc", "defects": [ "CSCwe29150" ], "discovery": "EXTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20318", "datePublished": "2024-03-13T16:46:24.113Z", "dateReserved": "2023-11-08T15:08:07.632Z", "dateUpdated": "2024-08-01T21:59:41.382Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-20315
Vulnerability from cvelistv5
Published
2024-03-13 16:45
Modified
2024-08-01 21:59
Severity ?
EPSS score ?
Summary
A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.
This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco IOS XR Software |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:cisco:ios_xr_software:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ios_xr_software", "vendor": "cisco", "versions": [ { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.10.1" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-20315", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-03-14T15:34:48.191531Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-19T17:25:44.385Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T21:59:41.535Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-iosxr-acl-bypass-RZU5NL3e", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "7.9.1" }, { "status": "affected", "version": "7.9.2" }, { "status": "affected", "version": "7.10.1" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.\r\n\r This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "Improper Access Control", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-13T16:45:58.046Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-iosxr-acl-bypass-RZU5NL3e", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e" } ], "source": { "advisory": "cisco-sa-iosxr-acl-bypass-RZU5NL3e", "defects": [ "CSCwf99658" ], "discovery": "INTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20315", "datePublished": "2024-03-13T16:45:58.046Z", "dateReserved": "2023-11-08T15:08:07.632Z", "dateUpdated": "2024-08-01T21:59:41.535Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.