Incomplete cleanup in Cisco Systems, Inc products - CVE-2024-20303
Published: March 28, 2024 / Updated: March 29, 2024
Vulnerability identifier: #VU87904
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-20303
CWE-ID: CWE-459
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incomplete cleanup in the multicast DNS (mDNS) gateway feature. A remote attacker on the local network can cause the wireless controller to have high CPU utilization, leading to denial of service condition.
Affected software
Catalyst 9800-CL Wireless Controllers for Cloud
Catalyst 9800 Embedded Wireless Controller
Catalyst 9800 Series Wireless Controllers
Embedded Wireless Controller on Catalyst Access Points
Cisco IOS XE
Catalyst 9800 Embedded Wireless Controller
Catalyst 9800 Series Wireless Controllers
Embedded Wireless Controller on Catalyst Access Points
Cisco IOS XE
How to mitigate CVE-2024-20303
Install updates from vendor's website.
Cisco IOS XE - addressed in versions 17.6.6, 17.9.4, 17.12.1, 17.13.1