VDB

CVE-2024-20259

CVE-2024-20259 PUBLISHED CVSS 6.800000190734863 MEDIUM

A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a crafted IPv4 DHCP request packet being mishandled when endpoint analytics are enabled. An attacker could exploit this vulnerability by sending a crafted DHCP request through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: The attack vector is listed as network because a DHCP relay anywhere on the network could allow exploits from networks other than the adjacent one.

EPSS 0.82% · 54.7th percentile

Risk Scores

CVSS 4.0
6.800000190734863
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.82%
54.7th percentile

Affected Products

VendorProductVersions
ciscoios_xe17.1.1, 17.1.1, 17.1.1
ciscoios_xe17.10.1, 17.1.1a, 17.1.1s
CiscoCisco IOS XE Software17.1.1, 17.1.1a, 17.1.3

Timeline

  • Mar 27, 2024 CVE Published
  • Mar 28, 2024 EPSS Score
  • Apr 23, 2024 EPSS Score
  • May 19, 2024 EPSS Score
  • Jun 13, 2024 EPSS Score
  • Jul 9, 2024 EPSS Score
  • Aug 4, 2024 EPSS Score
  • Aug 27, 2024 CVE Updated
  • Aug 30, 2024 EPSS Score
  • Sep 25, 2024 EPSS Score
  • Oct 4, 2024 Coalition ESS Score
  • Oct 20, 2024 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›