PT-2024-5089 · Cisco · Cisco Ios Xe+1

Published 2024-03-27 · Updated 2025-06-30 · CVE-2024-20308

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco IOS and Cisco IOS XE Software (affected versions not specified)

Description: A vulnerability in the IKEv1 fragmentation code could allow an unauthenticated, remote attacker to cause a heap underflow or corruption, resulting in an affected device reloading. This issue exists because crafted, fragmented IKEv1 packets are not properly reassembled. An attacker could exploit this vulnerability by sending crafted UDP packets to an affected system, potentially causing a denial of service (DoS) condition. The vulnerability can be triggered by both IPv4 and IPv6 traffic.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2024-05616

CVE-2024-20308

Affected Products

Cisco Ios

Cisco Ios Xe

References · 9

• https://safe-surf.ru/specialists/bulletins-nkcki/706372 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ikev1-NO2ccFWz · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05616 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20308 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20308 · Vendor Advisory
• https://twitter.com/vuldb/status/1773260502141178020 · Twitter Post
• https://t.me/cvenotify/127120 · Telegram Post
• https://twitter.com/CVEnew/status/1773096344791712005 · Twitter Post
• https://t.me/cvenotify/74932 · Telegram Post