#VU87521 Improper access control in Cisco Systems, Inc products - CVE-2024-20322


Vulnerability identifier: #VU87521

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-20322

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco IOS XR
Operating systems & Components / Operating system
IOS XR White box
Operating systems & Components / Operating system package or component
Cisco NCS 4001
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 4009
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 4016
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-12Z20G-SYS-A Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-12Z20G-SYS-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-24Q8L2DD-SYS Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-24Z8Q2C-SYS Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-28Z4C-SYS-A Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-28Z4C-SYS-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-6Z14S-SYS-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-6Z18G-SYS-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-ACC-SYS Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-FH-AGG Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540-FH-CSR-SYS Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-12Z16G-SYS-A Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-12Z16G-SYS-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-16Z4G8Q2C-A Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-16Z4G8Q2C-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-16Z8Q2C-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-4Z14G2Q-A Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-4Z14G2Q-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-6Z18G-SYS-A Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-6Z18G-SYS-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-8Z16G-SYS-A Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-8Z16G-SYS-D Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 540X-ACC-SYS Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 560-4-SYS Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 560-4-SYS-E Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 560-4-SYS-E-CC Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 560-7-SYS Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco NCS 560-7-SYS-E Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 4000 Series
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 500 Series Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 540 Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 540 Series Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5500 Series
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5501
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5501-SE
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5502
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5502-SE
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5504
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5508
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5516
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A1-24H
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A1-24Q6H-S
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A1-24Q6H-SS
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A1-36H
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A1-36H-SE
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A1-48Q6H
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A2-MOD-HD-S
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A2-MOD-S
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 55A2-MOD-SE-S
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 560 Router
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 560 Series Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 5700 Series
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 57B1-5DSE-SYS
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 57B1-6D24-SYS
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System 57C3-MOD
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System NCS-57C1-48Q6-SYS
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco Network Convergence System NCS-57D2-18DD-SYS
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper assignment of lookup keys to internal interface contexts. A remote attacker can access resources behind the affected device that are supposed to be protected by a configured ACL.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cisco IOS XR: 7.10.2 - 7.11.1

IOS XR White box: All versions

Cisco NCS 4001: All versions

Cisco NCS 4009: All versions

Cisco NCS 4016: All versions

Cisco NCS 540-12Z20G-SYS-A Router: All versions

Cisco NCS 540-12Z20G-SYS-D Router: All versions

Cisco NCS 540-24Q8L2DD-SYS Router: All versions

Cisco NCS 540-24Z8Q2C-SYS Router: All versions

Cisco NCS 540-28Z4C-SYS-A Router: All versions

Cisco NCS 540-28Z4C-SYS-D Router: All versions

Cisco NCS 540-6Z14S-SYS-D Router: All versions

Cisco NCS 540-6Z18G-SYS-D Router: All versions

Cisco NCS 540-ACC-SYS Router: All versions

Cisco NCS 540-FH-AGG Router: All versions

Cisco NCS 540-FH-CSR-SYS Router: All versions

Cisco NCS 540X-12Z16G-SYS-A Router: All versions

Cisco NCS 540X-12Z16G-SYS-D Router: All versions

Cisco NCS 540X-16Z4G8Q2C-A Router: All versions

Cisco NCS 540X-16Z4G8Q2C-D Router: All versions

Cisco NCS 540X-16Z8Q2C-D Router: All versions

Cisco NCS 540X-4Z14G2Q-A Router: All versions

Cisco NCS 540X-4Z14G2Q-D Router: All versions

Cisco NCS 540X-6Z18G-SYS-A Router: All versions

Cisco NCS 540X-6Z18G-SYS-D Router: All versions

Cisco NCS 540X-8Z16G-SYS-A Router: All versions

Cisco NCS 540X-8Z16G-SYS-D Router: All versions

Cisco NCS 540X-ACC-SYS Router: All versions

Cisco NCS 560-4-SYS Router: All versions

Cisco NCS 560-4-SYS-E Router: All versions

Cisco NCS 560-4-SYS-E-CC Router: All versions

Cisco NCS 560-7-SYS Router: All versions

Cisco NCS 560-7-SYS-E Router: All versions

Cisco Network Convergence System 4000 Series: All versions

Cisco Network Convergence System 500 Series Routers: All versions

Cisco Network Convergence System 540 Router: All versions

Cisco Network Convergence System 540 Series Routers: All versions

Cisco Network Convergence System 5500 Series: All versions

Cisco Network Convergence System 5501: All versions

Cisco Network Convergence System 5501-SE: All versions

Cisco Network Convergence System 5502: All versions

Cisco Network Convergence System 5502-SE: All versions

Cisco Network Convergence System 5504: All versions

Cisco Network Convergence System 5508: All versions

Cisco Network Convergence System 5516: All versions

Cisco Network Convergence System 55A1-24H: All versions

Cisco Network Convergence System 55A1-24Q6H-S: All versions

Cisco Network Convergence System 55A1-24Q6H-SS: All versions

Cisco Network Convergence System 55A1-36H: All versions

Cisco Network Convergence System 55A1-36H-SE: All versions

Cisco Network Convergence System 55A1-48Q6H: All versions

Cisco Network Convergence System 55A2-MOD-HD-S: All versions

Cisco Network Convergence System 55A2-MOD-S: All versions

Cisco Network Convergence System 55A2-MOD-SE-S: All versions

Cisco Network Convergence System 560 Router: All versions

Cisco Network Convergence System 560 Series Routers: All versions

Cisco Network Convergence System 5700 Series: All versions

Cisco Network Convergence System 57B1-5DSE-SYS: All versions

Cisco Network Convergence System 57B1-6D24-SYS: All versions

Cisco Network Convergence System 57C3-MOD: All versions

Cisco Network Convergence System NCS-57C1-48Q6-SYS: All versions

Cisco Network Convergence System NCS-57D2-18DD-SYS: All versions

External links
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Improper access control in Cisco IOS XR Software