CVE-2024-20474
published 2024-10-23CVE-2024-20474: A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause…
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.57%
43.4th percentile
A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client.
This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software.
Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client.
Affected
77 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
| cisco | cisco_secure_client | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Secure Client Software Denial of Service Vulnerability
vendor_cisco·2024-10-23·CVSS 4.3
CVE-2024-20474 [MEDIUM] CWE-191 Cisco Secure Client Software Denial of Service Vulnerability
Cisco Secure Client Software Denial of Service Vulnerability
A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client.
This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software.
Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client.
Cisco has released software updates that address this vulnerability. There are no workarounds that ad
Cisco
Cisco Secure Client Software Denial of Service Vulnerability
vendor_cisco·CVSS 3.1
CVE-2024-20474 Cisco Secure Client Software Denial of Service Vulnerability
CVE-2024-20474: Cisco Secure Client Software Denial of Service Vulnerability
A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client. This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software. Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client. Cisco has released software updates that address this vulnerability. There are no
CVSS:
GHSA
GHSA-f5rp-4vg3-xcrx: A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker
ghsa_unreviewed·2024-10-23
CVE-2024-20474 [MEDIUM] CWE-191 GHSA-f5rp-4vg3-xcrx: A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker
A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client.
This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software.
Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-23
Published