CVE-2024-20322
A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a confi
Description
A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL.
Weakness: CWE-284
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco IOS XR Software | Routing & Switching | cna-assigner |
Vendor-reported products (3)
- Cisco · Cisco IOS XR Software
- cisco · ios_xr_software
- cisco · ios_xr_software
Vendor advisory
cisco-sa-iosxr-acl-bypass-RZU5NL3e
Cisco IOS XR Software MPLS and Pseudowire Interfaces Access Control List Bypass Vulnerabilities
Cisco’s rating: Medium (advisory CVSS 5.8) · Published Mar 13, 2024
Bug IDs: CSCwf99658 , CSCwh77265
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from