CVSS: 8.6EPSS: 0%CPEs: 466EXPL: 0CVE-2024-20308
https://notcve.org/view.php?id=CVE-2024-20308
A vulnerability in the IKEv1 fragmentation code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a heap underflow, resulting in an affected device reloading. This vulnerability exists because crafted, fragmented IKEv1 packets are not properly reassembled. An attacker could exploit this vulnerability by sending crafted UDP packets to an affected system. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. Note: Only traffic that is directed to the affected system can be used to exploit this vulnerability. This vulnerability can be triggered by IPv4 and IPv6 traffic.. Una vulnerabilidad en el código de fragmentación IKEv1 del software Cisco IOS y Cisco IOS XE podría permitir que un atacante remoto no autenticado provoque un desbordamiento de almacenamiento dinámico, lo que resultaría en la recarga del dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ikev1-NO2ccFWz •
CVSS: 5.6EPSS: 0%CPEs: 338EXPL: 0CVE-2024-20309
https://notcve.org/view.php?id=CVE-2024-20309
A vulnerability in auxiliary asynchronous port (AUX) functions of Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload or stop responding. This vulnerability is due to the incorrect handling of specific ingress traffic when flow control hardware is enabled on the AUX port. An attacker could exploit this vulnerability by reverse telnetting to the AUX port and sending specific data after connecting. A successful exploit could allow the attacker to cause the device to reset or stop responding, resulting in a denial of service (DoS) condition. Una vulnerabilidad en las funciones del puerto asíncrono auxiliar (AUX) del software Cisco IOS XE podría permitir que un atacante local autenticado provoque que un dispositivo afectado se recargue o deje de responder. Esta vulnerabilidad se debe al manejo incorrecto del tráfico de entrada específico cuando el hardware de control de flujo está habilitado en el puerto AUX. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aux-333WBz8f • CWE-828: Signal Handler with Functionality that is not Asynchronous-Safe •
CVSS: 7.4EPSS: 0%CPEs: 65EXPL: 0CVE-2024-20303
https://notcve.org/view.php?id=CVE-2024-20303
A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper management of mDNS client entries. An attacker could exploit this vulnerability by connecting to the wireless network and sending a continuous stream of specific mDNS packets. A successful exploit could allow the attacker to cause the wireless controller to have high CPU utilization, which could lead to access points (APs) losing their connection to the controller and result in a DoS condition. Una vulnerabilidad en la función de puerta de enlace DNS de multidifusión (mDNS) del software Cisco IOS XE para controladores de LAN inalámbrica (WLC) podría permitir que un atacante adyacente no autenticado provoque una condición de denegación de servicio (DoS). Esta vulnerabilidad se debe a una gestión inadecuada de las entradas del cliente mDNS. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-mdns-dos-4hv6pBGf • CWE-459: Incomplete Cleanup •
CVSS: 6.5EPSS: 0%CPEs: 40EXPL: 0CVE-2024-20278
https://notcve.org/view.php?id=CVE-2024-20278
A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root. Una vulnerabilidad en la función NETCONF del software Cisco IOS XE podría permitir que un atacante remoto autenticado eleve los privilegios a root en un dispositivo afectado. Esta vulnerabilidad se debe a una validación inadecuada de la entrada proporcionada por el usuario. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX • CWE-184: Incomplete List of Disallowed Inputs •
CVSS: 6.0EPSS: 0%CPEs: 9EXPL: 0CVE-2024-20306
https://notcve.org/view.php?id=CVE-2024-20306
A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted CLI command to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-utd-cmd-JbL8KvHT • CWE-233: Improper Handling of Parameters •