Improper access control in Cisco Systems, Inc products - CVE-2024-20263
Published: January 24, 2024
Vulnerability identifier: #VU85778
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-20263
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco 250 Series Smart Switches
Cisco 350 Series Managed Switches
Cisco 350X Series Stackable Managed Switches
Cisco 550X Series Stackable Managed Switches
Business 250 Series Smart Switches
Business 350 Series Managed Switches
Cisco 250 Series Smart Switches
Cisco 350 Series Managed Switches
Cisco 350X Series Stackable Managed Switches
Cisco 550X Series Stackable Managed Switches
Business 250 Series Smart Switches
Business 350 Series Managed Switches
Detailed vulnerability description
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to incorrect processing of ACLs on a stacked configuration when either the primary or backup switches experience a full stack reload or power cycle. A remote attacker can send specially crafted traffic through the device to bypass configured ACLs, causing traffic to be dropped or forwarded in an unexpected manner.
How to mitigate CVE-2024-20263
Install updates from vendor's website.