CVE-2024-20322 — Improper Access Control in Cisco IOS XR Software

CWE-284 — Improper Access Control4 documents4 sources

Severity

5.8MEDIUMNVD

EPSS

0.1%

top 79.86%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS XR Software Cisco IOS XR

Timeline

PublishedMar 13

Description

A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected devi…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xr_software7.10.2, 7.11.1+1

▶NVDcisco/ios_xr7.10.2, 7.11+1

🔴Vulnerability Details

CVEList

CVE-2024-20322: A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an↗2024-03-13

▶

GHSA

GHSA-4wpx-q9gv-7mh7: A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an↗2024-03-13

▶

📋Vendor Advisories

Cisco

Cisco IOS XR Software MPLS and Pseudowire Interfaces Access Control List Bypass Vulnerabilities↗2024-03-13

▶