PT-2024-18647 · Cisco · Cisco Ios Xr

Published 2024-09-11 · Updated 2024-10-03 · CVE-2024-20317

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms (affected versions not specified)

Description A vulnerability in the handling of specific Ethernet frames could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a denial of service (DoS) condition. This issue is due to incorrect classification of certain types of Ethernet frames received on an interface. An attacker could exploit this by sending specific types of Ethernet frames to or through the affected device, potentially causing control plane protocol relationships to fail.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-684

Related Identifiers

BDU:2025-01648

CVE-2024-20317

Affected Products

Cisco Ios Xr

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-20317 · Security Note
• https://bdu.fstec.ru/vul/2025-01648 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-l2services-2mvHdNuC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20317 · Vendor Advisory
• https://t.me/cvenotify/94318 · Telegram Post
• https://t.me/cvedetector/5405 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833957216732217699 · Twitter Post
• https://t.me/cvenotify/96947 · Telegram Post
• https://twitter.com/CVEnew/status/1833923749554651202 · Twitter Post