6.7

CVE-2024-20456

A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Cisco Secure Boot functionality and load unverified software on an affected device. To exploit this successfully, the attacker must have root-system privileges on the affected device.

 This vulnerability is due to an error in the software build process. An attacker could exploit this vulnerability by manipulating the system’s configuration options to bypass some of the integrity checks that are performed during the booting process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass of the requirement to run Cisco signed images or alter the security properties of the running system.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Ios Xr Version24.2.1
   Cisco ≫ 8011-4g24y4h-i Version-
   Cisco ≫ 8101-32fh Version-
   Cisco ≫ 8101-32fh-o Version-
   Cisco ≫ 8101-32h-o Version-
   Cisco ≫ 8102-28fh-dpu-o Version-
   Cisco ≫ 8102-64h Version-
   Cisco ≫ 8102-64h-o Version-
   Cisco ≫ 8111-32eh-o Version-
   Cisco ≫ 8122-64eh-o Version-
   Cisco ≫ 8122-64ehf-o Version-
   Cisco ≫ 8201 Version-
   Cisco ≫ 8201-24h8fh Version-
   Cisco ≫ 8201-32fh Version-
   Cisco ≫ 8201-32fh-o Version-
   Cisco ≫ 8202 Version-
   Cisco ≫ 8202-32fh-m Version-
   Cisco ≫ 8212-48fh-m Version-
   Cisco ≫ 8404 Version-
   Cisco ≫ 8501-sys-mt Version-
   Cisco ≫ 8608 Version-
   Cisco ≫ 8700 Version-
   Cisco ≫ 8711-32fh-m Version-
   Cisco ≫ 8712-mod-m Version-
   Cisco ≫ 8804 Version-
   Cisco ≫ 8808 Version-
   Cisco ≫ 8812 Version-
   Cisco ≫ 8818 Version-
   Cisco ≫ Ncs 1010 Version-
   Cisco ≫ Ncs 1014 Version-
   Cisco ≫ Ncs 540-12z20g-sys-a Version-
   Cisco ≫ Ncs 540-12z20g-sys-d Version-
   Cisco ≫ Ncs 540-24q2c2dd-sys Version-
   Cisco ≫ Ncs 540-24q8l2dd-sys Version-
   Cisco ≫ Ncs 540-24z8q2c-sys Version-
   Cisco ≫ Ncs 540-28z4c-sys-a Version-
   Cisco ≫ Ncs 540-28z4c-sys-d Version-
   Cisco ≫ Ncs 540-6z14s-sys-d Version-
   Cisco ≫ Ncs 540-6z18g-sys-a Version-
   Cisco ≫ Ncs 540-6z18g-sys-d Version-
   Cisco ≫ Ncs 540-acc-sys Version-
   Cisco ≫ Ncs 540-fh-agg Version-
   Cisco ≫ Ncs 540-fh-csr-sys Version-
   Cisco ≫ Ncs 540x-12z16g-sys-a Version-
   Cisco ≫ Ncs 540x-12z16g-sys-d Version-
   Cisco ≫ Ncs 540x-16z4g8q2c-a Version-
   Cisco ≫ Ncs 540x-16z4g8q2c-d Version-
   Cisco ≫ Ncs 540x-16z8q2c-d Version-
   Cisco ≫ Ncs 540x-4z14g2q-a Version-
   Cisco ≫ Ncs 540x-4z14g2q-d Version-
   Cisco ≫ Ncs 540x-6z18g-sys-a Version-
   Cisco ≫ Ncs 540x-6z18g-sys-d Version-
   Cisco ≫ Ncs 540x-8z16g-sys-a Version-
   Cisco ≫ Ncs 540x-8z16g-sys-d Version-
   Cisco ≫ Ncs 540x-acc-sys Version-
   Cisco ≫ Ncs 57b1-5dse-sys Version-
   Cisco ≫ Ncs 57b1-6d24-sys Version-
   Cisco ≫ Ncs 57c1-48q6-sys Version-
   Cisco ≫ Ncs 57d2-18dd-sys Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.01% 0.006
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@cisco.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.