Vulnerability identifier: #VU85778

Vulnerability risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-20263

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco 250 Series Smart Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco 350 Series Managed Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco 350X Series Stackable Managed Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Cisco 550X Series Stackable Managed Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Business 250 Series Smart Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc
Business 350 Series Managed Switches
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor:

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to incorrect processing of ACLs on a stacked configuration when either the primary or backup switches experience a full stack reload or power cycle. A remote attacker can send specially crafted traffic through the device to bypass configured ACLs, causing traffic to be dropped or forwarded in an unexpected manner.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

---

External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-bus-acl-bypass-5zn9hNJk
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwf48882
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh68993

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.