7.4

CVE-2024-20327: cisco cisco ios xr software Improper Input Validation

CVSS: 7.4v3.1HighAnalyzed
Published 13-03-2024Last modified 01-08-2024
Open JSON

Vulnerability summary

CVE-2024-20327 is a high (CVSS 7.4) Improper Input Validation vulnerability in cisco cisco ios xr software. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.4/10
010
High · v3.1 (CVE.org)
EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-03-2024
    PublishedVulnerability first disclosed.
  2. 01-08-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of malformed PPPoE packets that are received on a router that is running Broadband Network Gateway (BNG) functionality with PPPoE termination on a Lightspeed-based or Lightspeed-Plus-based line card. An attacker could exploit this vulnerability by sending a crafted PPPoE packet to an affected line card interface that does not terminate PPPoE. A successful exploit could allow the attacker to crash the ppp_ma process, resulting in a DoS condition for PPPoE traffic across the router.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

0.00 pp

From 0.34% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cisco2 products
  • cisco ios xr software5.2.0 | 5.2.2 | 5.2.4 | 5.3.0 | 5.3.1 | 5.3.2 | 5.3.3 | 5.3.4 | 6.0.0 | 6.0.1 | 6.0.2 | 6.1.1 | 6.1.2 | 6.1.3 | 6.1.4 | 6.2.1 | 6.2.2 | 6.2.3 | 6.2.25 | 6.3.2 | 6.3.3 | 6.4.1 | 6.4.2 | 6.5.1 | 6.5.2 | 6.5.3 | 6.6.2 | 6.6.3 | 6.6.25 | 7.0.1 | 7.0.2 | 7.1.1 | 7.1.15 | 7.1.2 | 7.1.3 | 6.7.1 | 6.7.2 | 6.7.3 | 7.3.1 | 7.3.2 | 7.3.3 | 7.3.5 | 7.4.1 | 7.4.2 | 6.8.1 | 6.8.2 | 7.5.1 | 7.5.3 | 7.5.2 | 7.5.4 | 7.5.5 | 7.6.1 | 7.6.2 | 7.7.1 | 7.7.2 | 6.9.1 | 6.9.2 | 7.8.1 | 7.8.2 | 7.9.1 | 7.9.2
  • ios_xr< 7.9.21 | ≥ 7.10, < 7.10.1 | ≥ 7.11, < 7.11.1

1 vendor · 2 products

References

1 links