CVE-2024-20278
MEDIUMDescription
A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root.
Is your site exposed to CVE-2024-20278?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
| cisco | ios_xe |
References
Frequently Asked Questions
What is CVE-2024-20278? +
How severe is CVE-2024-20278? +
What products are affected by CVE-2024-20278? +
How do I check if I'm vulnerable to CVE-2024-20278? +
Related Vulnerabilities
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior …
Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the …
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device …
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist …