Skip to content
OpenAdvisories
High NCSC-2024-0371 4 CVEs

Kwetsbaarheden verholpen in Cisco IOS XR

Published Sep 13, 2024 · Updated Sep 13, 2024 · nl

Vendor: Cisco Product: ios_xr_software

Summary

Cisco heeft kwetsbaarheden verholpen in IOS XR.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, of om willekeurige code uit te voeren op het kwetsbare systeem.

Voor het veroorzaken van een Denial-of-Service heeft de kwaadwillende geen voorafgaande authenticatie nodig.

Voor het uitvoeren van willekeurige code heeft de kwaadwillende voorafgaande lokale authenticatie nodig.

Oplossingen
Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 4

  • High 8.8
    CVE-2024-20398

    Cisco IOS XR Software Local Privilege Escalation Vulnerability

    A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arg…

    Cisco Cisco IOS XR Software iOS Network devices
  • High 8.6
    CVE-2024-20304

    Cisco IOS XR Software Packet Memory Exhaustion Vulnerability

    A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device. This vulnerability exists because the Mtrace2 code does no…

    Cisco Cisco IOS XR Software iOS Network devices
  • High 7.4
    CVE-2024-20317

    Cisco IOS XR Software Layer 2 Services Denial of Service Vulnerability

    A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in …

    Cisco Cisco IOS XR Software iOS Network devices
  • High 7.4
    CVE-2024-20406

    Cisco IOS XR Software Intermediate System-to-Intermediate System Denial of Service Vulnerability

    A vulnerability in the segment routing feature for the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. T…

    Cisco Cisco IOS XR Software iOS Network devices

Revision history

  1. #0

    Initiele versie

References

  • Source - cisco
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-CrG5vhCq
  • Source - cisco
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-xehpbVNe
  • Source - cisco
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-l2services-2mvHdNuC
  • Source - cisco
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy