Vulnerability in Cisco Ios Xr Software
CVE-2024-20343
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device. This vulnerability is due to incorrect validation of the arguments that are passed to a specific CLI command. An attacker could exploit this vulnerability by logging in to an affected device with low-privileged credentials and using the affected command. A successful exploit could allow the attacker access files in read-only mode on the Linux file system.
EPSS: 0.001 (3.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Cisco Ios Xr Software — versions 6.5.3, 6.6.1, 6.5.2
- Cisco Ios_xr — versions 6.5.1, 6.5.2, 6.5.3
- Linux Linux_kernel
Weakness classification (CWE)
References
- psirt@cisco.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-20343?
- CVE-2024-20343 is a medium-severity vulnerability in Cisco Ios Xr Software, classified under Improper Access Control. CVSS score: 5.5/10. Published 2024-09-11.
- How severe is CVE-2024-20343?
- Medium severity. CVSS v3 base score is 5.5 out of 10.