CVE-2024-20434
Cisco Cisco IOS XE Software
At a glance
- Source
- NVD
- EPSS
- EPSS 0.26 % · percentile 17 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Analyzed
Description
A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the control plane of an affected device. This vulnerability is due to improper handling of frames with VLAN tag information. An attacker could exploit this vulnerability by sending crafted frames to an affected device. A successful exploit could allow the attacker to render the control plane of the affected device unresponsive. The device would not be accessible through the console or CLI, and it would not respond to ping requests, SNMP requests, or requests from other control plane protocols. Traffic that is traversing the device through the data plane is not affected. A reload of the device is required to restore control plane services.
Weaknesses (CWE)
- CWE-190 — Integer Overflow or Wraparound
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | cisco |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · psirt@cisco.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-18149
- GCVE · GCVE-0-2024-20434
Affected configurations (NVD CPE)
cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.4:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.4a:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.5:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.6:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.7:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.8:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.9:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.6.10:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.7.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.8.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.8.1a:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.8.1s:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.1s:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.4:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.5:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.6:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.7:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.9.8:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.10.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.10.1e:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.10.1s:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.11.1b:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.11.1s:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.1c:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.2s:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.3a:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.3s:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.4:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios_xe:16.12.4a:*:*:*:*:*:*:*- +51 more
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco IOS XE Software | affected 16.6.1 ; affected 16.6.2 ; affected 16.6.3 ; affected 16.6.4 ; affected 16.6.5 ; affected 16.6.4a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |