CVSS: 5.6EPSS: 0%CPEs: 338EXPL: 0CVE-2024-20309
https://notcve.org/view.php?id=CVE-2024-20309
A vulnerability in auxiliary asynchronous port (AUX) functions of Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload or stop responding. This vulnerability is due to the incorrect handling of specific ingress traffic when flow control hardware is enabled on the AUX port. An attacker could exploit this vulnerability by reverse telnetting to the AUX port and sending specific data after connecting. A successful exploit could allow the attacker to cause the device to reset or stop responding, resulting in a denial of service (DoS) condition. Una vulnerabilidad en las funciones del puerto asíncrono auxiliar (AUX) del software Cisco IOS XE podría permitir que un atacante local autenticado provoque que un dispositivo afectado se recargue o deje de responder. Esta vulnerabilidad se debe al manejo incorrecto del tráfico de entrada específico cuando el hardware de control de flujo está habilitado en el puerto AUX. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aux-333WBz8f • CWE-828: Signal Handler with Functionality that is not Asynchronous-Safe •
CVSS: 7.4EPSS: 0%CPEs: 65EXPL: 0CVE-2024-20303
https://notcve.org/view.php?id=CVE-2024-20303
A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper management of mDNS client entries. An attacker could exploit this vulnerability by connecting to the wireless network and sending a continuous stream of specific mDNS packets. A successful exploit could allow the attacker to cause the wireless controller to have high CPU utilization, which could lead to access points (APs) losing their connection to the controller and result in a DoS condition. Una vulnerabilidad en la función de puerta de enlace DNS de multidifusión (mDNS) del software Cisco IOS XE para controladores de LAN inalámbrica (WLC) podría permitir que un atacante adyacente no autenticado provoque una condición de denegación de servicio (DoS). Esta vulnerabilidad se debe a una gestión inadecuada de las entradas del cliente mDNS. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-mdns-dos-4hv6pBGf • CWE-459: Incomplete Cleanup •
CVSS: 8.6EPSS: 0%CPEs: 181EXPL: 0CVE-2024-20314
https://notcve.org/view.php?id=CVE-2024-20314
A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization and stop all traffic processing, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain IPv4 packets. An attacker could exploit this vulnerability by sending certain IPv4 packets to an affected device. A successful exploit could allow the attacker to cause the device to exhaust CPU resources and stop processing traffic, resulting in a DoS condition. Una vulnerabilidad en la función de nodo de borde de la estructura de acceso definido por software (SD-Access) IPv4 del software Cisco IOS XE podría permitir que un atacante remoto no autenticado cause una alta utilización de la CPU y detenga todo el procesamiento del tráfico, lo que resultaría en una denegación de servicio (DoS). condición en un dispositivo afectado. Esta vulnerabilidad se debe al manejo inadecuado de ciertos paquetes IPv4. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sda-edge-dos-qZWuWXWG • CWE-783: Operator Precedence Logic Error •
CVSS: 7.4EPSS: 0%CPEs: 441EXPL: 0CVE-2024-20312
https://notcve.org/view.php?id=CVE-2024-20312
A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation when parsing an ingress IS-IS packet. An attacker could exploit this vulnerability by sending a crafted IS-IS packet to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and have formed an adjacency. Una vulnerabilidad en el protocolo de sistema intermedio a sistema intermedio (IS-IS) del software Cisco IOS y del software Cisco IOS XE podría permitir que un atacante adyacente no autenticado cause una condición de denegación de servicio (DoS) en un dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-sGjyOUHX • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 60EXPL: 0CVE-2024-20324
https://notcve.org/view.php?id=CVE-2024-20324
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, local attacker to access WLAN configuration details including passwords. This vulnerability is due to improper privilege checks. An attacker could exploit this vulnerability by using the show and show tech wireless CLI commands to access configuration details, including passwords. A successful exploit could allow the attacker to access configuration details that they are not authorized to access. Una vulnerabilidad en la CLI del software Cisco IOS XE podría permitir que un atacante local autenticado y con pocos privilegios acceda a los detalles de configuración de WLAN, incluidas las contraseñas. Esta vulnerabilidad se debe a comprobaciones de privilegios inadecuadas. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-wlc-privesc-RjSMrmPK • CWE-274: Improper Handling of Insufficient Privileges •