CyberCVE

CVE-2024-20436

A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthenticated, remote attacker to cause a denial of service (DoS) con

Severity
High 8.6
CVSS 3.1
Exploited
Not listed
EPSS
0.009
57.0th percentile
Discovered by
Vendor
Vendor-published field
Published
Sep 25, 2024
Assigned by cisco

Description

A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a null pointer dereference when accessing specific URLs. An attacker could exploit this vulnerability by sending crafted HTTP traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, causing a DoS condition on the affected device.

Weakness: CWE-476

Affected products

Vendor Product Category Matched by
Cisco Cisco IOS XE Software Routing & Switching cna-assigner
Vendor-reported products (2)
  • Cisco · Cisco IOS XE Software
  • cisco · ios_xe

References

Something wrong here?