PT-2023-9646 · Cisco · Cisco Ios Xe

Published 2023-11-08 · Updated 2024-10-08 · CVE-2024-20434

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to improper handling of frames with VLAN tag information, which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the control plane of an affected device. An attacker could exploit this by sending crafted frames to an affected device, rendering the control plane unresponsive. The device would not be accessible through the console or CLI and would not respond to ping requests, SNMP requests, or requests from other control plane protocols. Traffic traversing the device through the data plane is not affected. A reload of the device is required to restore control plane services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2024-09174

CVE-2024-20434

Affected Products

Cisco Ios Xe

References · 8

• https://osv.dev/vulnerability/CVE-2024-20434 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20434 · Security Note
• https://bdu.fstec.ru/vul/2024-09174 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vlan-dos-27Pur5RT · Vendor Advisory
• https://t.me/cvedetector/6346 · Telegram Post
• https://vuldb.com/?id.278496 · Note
• https://t.me/cvenotify/97471 · Telegram Post
• https://twitter.com/CVEnew/status/1838983826669789401 · Twitter Post