PT-2024-1298 · Cisco · Cisco Business 250 Series Smart Switches+1

Published

2024-01-24

·

Updated

2024-02-06

·

CVE-2024-20263

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions Cisco Business 250 Series Smart Switches (affected versions not specified) Cisco Business 350 Series Managed Switches (affected versions not specified)
Description A vulnerability with the access control list (ACL) management within a stacked switch configuration could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. This issue is due to incorrect processing of ACLs on a stacked configuration when either the primary or backup switches experience a full stack reload or power cycle. An attacker could exploit this by sending crafted traffic through an affected device, potentially allowing them to bypass configured ACLs and causing traffic to be dropped or forwarded in an unexpected manner.
Recommendations For Cisco Business 250 Series Smart Switches, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Business 350 Series Managed Switches, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

Related Identifiers

BDU:2024-00737
CVE-2024-20263

Affected Products

Cisco Business 250 Series Smart Switches
Cisco Business 350 Series Managed Switches