CyberSecBulletin
CVE-2024-20317NVD status: Analyzed

Cisco IOS XR Software: Incorrect Provision of Specified Functionality

Published Updated By the CyberSecBulletin desk

CVE-2024-20317 is a high-severity incorrect provision of specified functionality vulnerability in Cisco IOS XR Software from Cisco, with a CVSS 3.1 base score of 7.4 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. Affected Cisco IOS XR Software versions: 7.7.1; 7.8.1; 7.7.2, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of Cisco IOS XR Software you run against the affected versions below, and install the vendor's latest release.
  2. Read the advisory on sec.cloudapps.cisco.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
CiscoCisco IOS XR Software7.7.1; 7.8.1; 7.7.2; 7.9.1; 7.8.2; 7.8.22; 7.10.1; 7.7.21; and 2 more rangesNot stated
CiscoiOS Xr7.7.1; 7.7.2; 7.7.21; 7.8.1; 7.8.2; 7.8.22; 7.9.1; 7.9.2; and 2 more rangesNot stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.4HighCNA (cisco.com)
CVSS 3.17.4HighNVD

Official description

A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect classification of certain types of Ethernet frames that are received on an interface. An attacker could exploit this vulnerability by sending specific types of Ethernet frames to or through the affected device. A successful exploit could allow the attacker to cause control plane protocol relationships to fail, resulting in a DoS condition. For more information, see the section of this advisory. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Incorrect Provision of Specified Functionality

The code does not function according to its published specifications, potentially leading to incorrect usage.

How developers prevent this class of flaw

  • Ensure that your code strictly conforms to specifications.

More Incorrect Provision of Specified Functionality vulnerabilities (CWE-684)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Cisco IOS XR Software

All Cisco IOS XR Software vulnerabilities

Recent Incorrect Provision of Specified Functionality vulnerabilities

Spotted an error? Tell us.