PT-2024-2577 · Cisco · Cisco Ios Xe

Published 2024-03-27 · Updated 2025-07-30 · CVE-2024-20309

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the auxiliary asynchronous port (AUX) functions could allow an authenticated, local attacker to cause an affected device to reload or stop responding. This issue is due to the incorrect handling of specific ingress traffic when flow control hardware is enabled on the AUX port. An attacker could exploit this by reverse telnetting to the AUX port and sending specific data after connecting, potentially causing a denial of service (DoS) condition.

Recommendations For all affected versions, update to the latest software version that addresses this vulnerability. As a temporary workaround, consider disabling the flow control hardware on the AUX port until a patch is available. Restrict access to the AUX port to minimize the risk of exploitation. Avoid using reverse telnet to the AUX port until the issue is resolved. Apply the workarounds provided by Cisco to address this vulnerability.

Fix

DoS

Weakness Enumeration

CWE-828

Related Identifiers

BDU:2024-02633

CVE-2024-20309

Affected Products

Cisco Ios Xe

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aux-333WBz8f · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02633 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20309 · Security Note
• https://twitter.com/CVEnew/status/1773096350059757677 · Twitter Post
• https://twitter.com/SystemTek_UK/status/1773817506622316869 · Twitter Post
• https://t.me/cveNotify/130247 · Telegram Post