ACL bypass in Cisco Small Business Series Switches

1) Improper access control

EUVDB-ID: #VU85778

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-20263

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to incorrect processing of ACLs on a stacked configuration when either the primary or backup switches experience a full stack reload or power cycle. A remote attacker can send specially crafted traffic through the device to bypass configured ACLs, causing traffic to be dropped or forwarded in an unexpected manner.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco 250 Series Smart Switches: before 2.5.9.54

Cisco 350 Series Managed Switches: before 2.5.9.54

Cisco 350X Series Stackable Managed Switches: before 2.5.9.54

Cisco 550X Series Stackable Managed Switches: before 2.5.9.54

Business 250 Series Smart Switches: before 3.4.0.17

Business 350 Series Managed Switches: before 3.4.0.17

CPE2.3

• cpe:2.3:h:cisco_systems:cisco_250_series_smart_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_350_series_managed_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_350x_series_stackable_managed_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_550x_series_stackable_managed_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:business_250_series_smart_switches:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:business_350_series_managed_switches:*:*:*:*:*:*:*:*

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-bus-acl-bypass-5zn9hNJk
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwf48882
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh68993

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.