CVE-2024-20278

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to the NETCONF feature of Cisco IOS XE Software, where improper validation of user-supplied input could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This is due to the use of an incomplete blacklist when processing input data. An attacker could exploit this by sending crafted input over NETCONF to an affected device, potentially allowing them to elevate privileges from Administrator to root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.