CVE-2024-20266: Null Pointer Dereference
First published: Wed Mar 13 2024(Updated: )
A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition. This vulnerability exists because certain DHCPv4 messages are improperly validated when they are processed by an affected device. An attacker could exploit this vulnerability by sending a malformed DHCPv4 message to an affected device. A successful exploit could allow the attacker to cause a crash of the dhcpd process. While the dhcpd process is restarting, which may take approximately two minutes, DHCPv4 server services are unavailable on the affected device. This could temporarily prevent network access to clients that join the network during that time period and rely on the DHCPv4 server of the affected device. Notes: Only the dhcpd process crashes and eventually restarts automatically. The router does not reload. This vulnerability only applies to DHCPv4. DHCP version 6 (DHCPv6) is not affected.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XRv 9000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20266?
CVE-2024-20266 has a high severity rating as it can lead to a denial of service condition.
How do I fix CVE-2024-20266?
To fix CVE-2024-20266, update to the latest version of Cisco IOS XR Software that addresses this vulnerability.
What effect does CVE-2024-20266 have on affected systems?
CVE-2024-20266 can cause an unauthorized remote attacker to crash the dhcpd process, resulting in a denial of service.
Is there a workaround for CVE-2024-20266?
There are currently no recommended workarounds for CVE-2024-20266; upgrading the software is advised.
Which versions of Cisco IOS XR Software are affected by CVE-2024-20266?
CVE-2024-20266 affects all versions of Cisco IOS XR Software that include the DHCP version 4 server feature.
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xrv 9000