Cisco IOS and IOS XE Software Vulnerability Could Lead to Device Reload and Denial of Service
CVE-2024-20311

8.6HIGH

Key Information:

Vendor
Cisco
Status
iOS
Cisco iOS Xe Software
Vendor
CVE Published:
27 March 2024

Badges

👾 Exploit Exists

Summary

The vulnerability arises from the improper handling of Locator ID Separation Protocol (LISP) packets within Cisco IOS Software and Cisco IOS XE Software. An unauthenticated remote attacker can exploit this flaw by sending specially crafted LISP packets to targeted devices. This could result in the affected device experiencing a reload, effectively leading to a denial of service condition. The exploitation can occur over both IPv4 and IPv6 transport mechanisms, amplifying the potential impact on affected networks.

Affected Version(s)

Cisco IOS XE Software 3.7.0S

Cisco IOS XE Software 3.7.1S

Cisco IOS XE Software 3.7.2S

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.