CVE-2024-20455

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the process that classifies traffic going to the Unified Threat Defense (UTD) component could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because UTD improperly handles certain packets as those packets egress an SD-WAN IPsec tunnel. An attacker could exploit this vulnerability by sending crafted traffic through an SD-WAN IPsec tunnel that is configured on an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note that SD-WAN tunnels configured with Generic Routing Encapsulation (GRE) are not affected by this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the SD-WAN IPsec tunnel to minimize the risk of exploitation. Avoid using the SD-WAN IPsec tunnel until the issue is resolved. Cisco has released software updates that address this vulnerability, it is recommended to apply these updates to fix the issue.