PT-2024-2551 · Cisco · Cisco Ios Xe

Andrej Mikus · Published 2024-03-27 · Updated 2025-07-30 · CVE-2024-20316

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to improper handling of error conditions in the Data Model Interface (DMI) services of Cisco IOS XE Software when a device administrator updates an IPv4 access control list (ACL) using the NETCONF or RESTCONF protocol. This could allow an unauthenticated, remote attacker to access resources that should have been protected by a configured IPv4 ACL. The vulnerability arises when the update reorders access control entries (ACEs) in the updated ACL.

Recommendations For Cisco IOS XE Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the NETCONF and RESTCONF protocols until a patch is available. Avoid using the affected DMI services until the issue is resolved. There are workarounds available that address this vulnerability, as described in the Cisco security advisory.

Fix

Weakness Enumeration

CWE-390

Related Identifiers

BDU:2024-02559

CVE-2024-20316

Affected Products

Cisco Ios Xe

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-20316 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dmi-acl-bypass-Xv8FO8Vz · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20316 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02559 · Security Note
• https://twitter.com/CVEnew/status/1773096361686368500 · Twitter Post
• https://t.me/cveNotify/130241 · Telegram Post