CVE-2024-20304

CVE-2024-20304 affects Cisco IOS XR Software where the Mtrace2 feature mishandles packet memory, allowing an unauthenticated, remote attacker to exhaust incoming UDP packet memory and potentially cause DoS. Impact is network-based with availability loss; exploit can be performed over IPv4 or IPv6...

CVE-2024-20489 Cisco Routed Passive Optical Network Cleartext Password Vulnerability

A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running...

CVE-2024-20489

CVE-2024-20489 affects Cisco IOS XR Software running PON Controller, where the storage of unencrypted database credentials in the configuration files allows an authenticated, local attacker with low privileges to view MongoDB credentials. The root cause is improper storage of credentials on the d...

CVE-2024-20489 Cisco Routed Passive Optical Network Cleartext Password Vulnerability

A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running...

CVE-2024-20483

CVE-2024-20483 involves multiple vulnerabilities in Cisco Routed PON Controller Software (Docker container on Cisco IOS XR hardware) where insufficient validation of arguments to configuration commands can allow an authenticated, admin-level attacker on the PON Manager or direct access to its Mon...

CVE-2024-20317 Cisco IOS XR Software Layer 2 Services Denial of Service Vulnerability

A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System NCS platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a denial of service DoS condition. This...

CVE-2024-20398

Cisco IOS XR Software CLI vulnerability allows an authenticated, local attacker with a low-privileged account to craft commands at the prompt to gain read/write access to the underlying filesystem and potentially elevate to root. Root cause: insufficient validation of user arguments for specific ...

CVE-2024-20398 Cisco IOS XR Software Local Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI...

CVE-2024-20390 Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service Vulnerability

A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could explo...

CVE-2024-20390 Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service Vulnerability

A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could explo...

CVE-2024-20390

CVE-2024-20390 affects Cisco IOS XR Software, specifically the Dedicated XML Agent. The root cause is a lack of proper error validation of ingress XML packets, which can be exploited by an unauthenticated, remote attacker sending a sustained stream of crafted XML traffic to the XML TCP listen por...

CVE-2024-20343 Cisco IOS XR Software CLI Arbitrary File Read Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device. This vulnerability is due to incorrect validation of the...

CVE-2024-20343

Cisco IOS XR Software CLI Arbitrary File Read vulnerability (CVE-2024-20343) allows an authenticated, local attacker to read files from the underlying Linux filesystem due to improper validation of CLI command arguments. Exploitation requires valid credentials on the affected device and uses a lo...

CVE-2024-20343 Cisco IOS XR Software CLI Arbitrary File Read Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device. This vulnerability is due to incorrect validation of the...

Cisco IOS XR Software UDP Packet Memory Exhaustion Vulnerability

A vulnerability in the multicast traceroute version 2 Mtrace2 feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device. This vulnerability exists because the Mtrace2 code does not properly handle packet memory. An...

Cisco IOS XR Software Network Convergence System Denial of Service Vulnerability

A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System NCS platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a denial of service DoS condition. This...

Cisco IOS XR Software CLI Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI...

Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service Vulnerability

A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could explo...

Cisco IOS XR Software CLI Arbitrary File Read Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device. This vulnerability is due to incorrect validation of the...

Cisco Routed Passive Optical Network Controller Vulnerabilities

Multiple vulnerabilities in Cisco Routed Passive Optical Network PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker to perform command injection attacks, execute arbitrary commands on the...