This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Cisco fixes 15 vulnerabilities in various products

Cisco IOS XE - privileges escalation (CVE-2024-20278)
CVSS 6.5 (Medium)

An authenticated remote attacker with administrator privileges can elevate their privileges to root in IOS XE [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 27. 4. 2024.

Cisco IOS and IOS XE - DoS (CVE-2024-20312)
CVSS 7.4 (High)

An unauthenticated remote attacker can carry out a DoS attack in IOS and IOS XE [2].

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 27. 3. 2024.

Cisco IOS and IOS XE - DoS
CVSS 8.6 (High)

An unauthenticated remote attacker can cause a DoS attack in IOS and IOS XE [3][4][5].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 27. 3. 2024.

Cisco IOS XE - unauthorized access
CVSS 5.8 (Medium)

An unauthenticated remote attacker can gain unauthorized access to protected resources in IOS and IOS XE [6].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 27. 4. 2024.

Cisco IOS and IOS XE - DoS
CVSS 7.4 (High)

An unauthenticated local attacker can carry out a DoS attack in IOS and IOS XE [7][8].

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 27. 3. 2024.

Cisco IOS XE - RCE (CVE-2024-20306)
CVSS 6.0 (Medium)

An authenticated local attacker with privilege level 15 can execute commands with root privileges in IOS XE without authorization [9].

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 27. 3. 2024.

Cisco Access Point - security check bypass (CVE-2024-20265)
CVSS 5.9 (Medium)

An unauthenticated physical attacker can bypass security checks in Access Point and upload potentially malicious software to the affected device [10].

CVSS: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 27. 4. 2024.

Cisco Access Point - DoS (CVE-2024-20354)
CVSS 4.7 (Medium)

An unauthenticated local attacker can cause a DoS attack in Access Point [11].

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

More information:

The vulnerability was publicly disclosed 27. 3. 2024.

CIsco Catalyst Center - unauthorized modification (CVE-2024-20333)
CVSS 4.3 (Medium)

An authenticated remote attacker can make unauthorized changes to certain data within the web interface of Catalyst Center [12].

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 27. 3. 2024.

Cisco fixes 15 vulnerabilities in the IOS, IOS XE, Catalyst Center and Access Point products. The fix for Catalyst Center is available in version 2.3.5.4 [12], and the fixed versions for all types of affected Access Point hardware can be found at [10][11]. The remaining fixed versions can be obtained at [13], where you must enter the type and version of your product on the first page. On the next page, you must select all impact ratings and all security advisories. On the last page, you must select the highest of the displayed fixed versions and update your affected device to it. Most severe vulnerabilities:

By CESNET, z.s.p.o. Martin Krajči on 4. 4. 2024.

CESNET, z.s.p.o. Logo