Vulnerability identifier: #VU87888

Vulnerability risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-20265

CWE-ID: CWE-501

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
6300 Series Embedded Services Access Points
Other software / Other software solutions
Aironet 4800 Access Points
Other software / Other software solutions
Business 100 Series Mesh Extenders
Other software / Other software solutions
Business 200 Series Access Points
Other software / Other software solutions
Catalyst 9105AX Series Access Points
Other software / Other software solutions
Catalyst 9120AX Series Access Points
Other software / Other software solutions
Catalyst 9124AX Series
Other software / Other software solutions
Catalyst 9130AX Series Access Points
Other software / Other software solutions
Catalyst Cellular Gateways
Other software / Other software solutions
Catalyst IW6300 Heavy Duty Series Access Points
Other software / Other software solutions
Wireless LAN Controller Software
Other software / Other software solutions
Cisco Aironet 1540 Series Access Points
Hardware solutions / Routers & switches, VoIP, GSM, etc
Aironet 1560 Series Access Points
Hardware solutions / Routers & switches, VoIP, GSM, etc
Aironet 1800 Series Access Points
Hardware solutions / Routers & switches, VoIP, GSM, etc
Aironet 2800 Series Access Points
Hardware solutions / Routers & switches, VoIP, GSM, etc
Aironet 3800 Series Access Points
Hardware solutions / Routers & switches, VoIP, GSM, etc
Catalyst 9115 Series Access Points
Hardware solutions / Routers & switches, VoIP, GSM, etc
Catalyst 9136 Series Access Points
Hardware solutions / Routers & switches, VoIP, GSM, etc
Wide Pluggable Form Factor Wi-Fi 6 AP Module for Industrial Routers
Hardware solutions / Routers & switches, VoIP, GSM, etc
Business Wireless Access Point Software
Hardware solutions / Firmware
Catalyst 9800 Series Wireless Controller Software
Hardware solutions / Firmware

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to unnecessary commands are available during boot time at the physical console. An authenticated attacker with physical access can bypass the Cisco Secure Boot functionality and load arbitrary software image on the target device.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

6300 Series Embedded Services Access Points: All versions

Cisco Aironet 1540 Series Access Points: All versions

Aironet 1560 Series Access Points: All versions

Aironet 1800 Series Access Points: All versions

Aironet 2800 Series Access Points: All versions

Aironet 3800 Series Access Points: All versions

Aironet 4800 Access Points: All versions

Business 100 Series Mesh Extenders: All versions

Business 200 Series Access Points: All versions

Catalyst 9105AX Series Access Points: All versions

Catalyst 9115 Series Access Points: All versions

Catalyst 9120AX Series Access Points: All versions

Catalyst 9124AX Series: All versions

Catalyst 9130AX Series Access Points: All versions

Catalyst 9136 Series Access Points: All versions

Catalyst Cellular Gateways: All versions

Catalyst IW6300 Heavy Duty Series Access Points: All versions

Wide Pluggable Form Factor Wi-Fi 6 AP Module for Industrial Routers: All versions

Wireless LAN Controller Software: 8.9 - 8.10

Business Wireless Access Point Software: 10.5.2 - 10.9.1

Catalyst 9800 Series Wireless Controller Software: 17.2 - 17.11

---

External links
http://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-secureboot-bypass-zT5vJkSD

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.