PT-2024-2707 · Cisco · Cisco Ios Xe

X.B · Published 2024-03-27 · Updated 2025-08-01 · CVE-2024-20278

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to the NETCONF feature of Cisco IOS XE Software, where improper validation of user-supplied input could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This is due to the use of an incomplete blacklist when processing input data. An attacker could exploit this by sending crafted input over NETCONF to an affected device, potentially allowing them to elevate privileges from Administrator to root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

BDU:2024-02820

CVE-2024-20278

Affected Products

Cisco Ios Xe

References · 7

• https://osv.dev/vulnerability/CVE-2024-20278 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20278 · Security Note
• https://bdu.fstec.ru/vul/2024-02820 · Security Note
• https://t.me/cveNotify/130550 · Telegram Post
• https://twitter.com/CVEnew/status/1773096353167749273 · Twitter Post
• https://t.me/cvenotify/74865 · Telegram Post