Skip to content
OpenAdvisories
High WID-SEC-2024-2125 6 CVEs

Cisco IOS XR: Mehrere Schwachstellen

Published Sep 11, 2024 · Updated Sep 11, 2024 · de-DE

Vendor: Cisco Product: IOS XR

Summary

Ein Angreifer kann mehrere Schwachstellen in Cisco IOS XR ausnutzen, um einen Denial of Service Angriff durchzuführen, erhöhte Rechte zu erlangen und vertrauliche Informationen preiszugeben.

Product

Cisco Internetwork Operating System (IOS) ist ein Betriebssystem, das für Cisco Geräte wie z. B. Router und Switches eingesetzt wird.

Vulnerabilities 6

  • High 8.8
    CVE-2024-20398

    Cisco IOS XR Software Local Privilege Escalation Vulnerability

    A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arg…

    Cisco Cisco IOS XR Software iOS Network devices
  • High 8.6
    CVE-2024-20304

    Cisco IOS XR Software Packet Memory Exhaustion Vulnerability

    A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device. This vulnerability exists because the Mtrace2 code does no…

    Cisco Cisco IOS XR Software iOS Network devices
  • High 7.4
    CVE-2024-20317

    Cisco IOS XR Software Layer 2 Services Denial of Service Vulnerability

    A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in …

    Cisco Cisco IOS XR Software iOS Network devices
  • High 7.4
    CVE-2024-20406

    Cisco IOS XR Software Intermediate System-to-Intermediate System Denial of Service Vulnerability

    A vulnerability in the segment routing feature for the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. T…

    Cisco Cisco IOS XR Software iOS Network devices
  • Medium 5.5
    CVE-2024-20343

    Cisco IOS XR Software CLI Arbitrary File Read Vulnerability

    A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device. This vulnerability …

    Cisco Cisco IOS XR Software iOS Network devices
  • Medium 5.3
    CVE-2024-20390

    Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service Vulnerability

    A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingr…

    Cisco Cisco IOS XR Software iOS Network devices

Revision history

  1. #1

    Initiale Fassung

References