What is CVE-2024-20278?

CVE-2024-20278 is a medium-severity vulnerability in Cisco Ios Xe Software, classified under Incomplete List of Disallowed Inputs. CVSS score: 6.5/10. Published 2024-03-27.

How severe is CVE-2024-20278?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Cisco Ios Xe Software

CVE-2024-20278

A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root.

EPSS: 0.005 (42.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.

Affected products

Cisco Ios Xe Software — versions 17.6.1, 17.6.2, 17.6.1w
Cisco Ios_xe — versions 17.6.1, 17.6.1a, 17.6.1w

Weakness classification (CWE)

CWE-184 — Incomplete List of Disallowed Inputs

References

psirt@cisco.com (Vendor Advisory)

Frequently asked questions

What is CVE-2024-20278?: CVE-2024-20278 is a medium-severity vulnerability in Cisco Ios Xe Software, classified under Incomplete List of Disallowed Inputs. CVSS score: 6.5/10. Published 2024-03-27.
How severe is CVE-2024-20278?: Medium severity. CVSS v3 base score is 6.5 out of 10.