Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-20322

A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL.

Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 5.8, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts limited integrity, for affected systems. Impacting 76 products from cisco, from cisco, from cisco and 73 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2024, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2024-03-13T17:15:48.407

Last Modified

2025-08-05T14:41:53.510

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.8 (MEDIUM)

Weaknesses

Type: Secondary
CWE-284

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	cisco	ios_xr	7.10.2	Yes
Operating System	cisco	ios_xr	7.11	Yes
Hardware	cisco	8011-4g24y4h-i	-	No
Hardware	cisco	8101-32fh	-	No
Hardware	cisco	8101-32fh-o	-	No
Hardware	cisco	8101-32h-o	-	No
Hardware	cisco	8102-28fh-dpu-o	-	No
Hardware	cisco	8102-64h	-	No
Hardware	cisco	8102-64h-o	-	No
Hardware	cisco	8111-32eh-o	-	No
Hardware	cisco	8122-64eh-o	-	No
Hardware	cisco	8122-64ehf-o	-	No
Hardware	cisco	8201	-	No
Hardware	cisco	8201-24h8fh	-	No
Hardware	cisco	8201-32fh	-	No
Hardware	cisco	8201-32fh-o	-	No
Hardware	cisco	8202	-	No
Hardware	cisco	8202-32fh-m	-	No
Hardware	cisco	8212-48fh-m	-	No
Hardware	cisco	8404	-	No
Hardware	cisco	8501-sys-mt	-	No
Hardware	cisco	8608	-	No
Hardware	cisco	8700	-	No
Hardware	cisco	8711-32fh-m	-	No
Hardware	cisco	8712-mod-m	-	No
Hardware	cisco	8804	-	No
Hardware	cisco	8808	-	No
Hardware	cisco	8812	-	No
Hardware	cisco	8818	-	No
Hardware	cisco	ncs_540-12z20g-sys-a	-	No
Hardware	cisco	ncs_540-12z20g-sys-d	-	No
Hardware	cisco	ncs_540-24q2c2dd-sys	-	No
Hardware	cisco	ncs_540-24q8l2dd-sys	-	No
Hardware	cisco	ncs_540-24z8q2c-sys	-	No
Hardware	cisco	ncs_540-28z4c-sys-a	-	No
Hardware	cisco	ncs_540-28z4c-sys-d	-	No
Hardware	cisco	ncs_540-6z14s-sys-d	-	No
Hardware	cisco	ncs_540-6z18g-sys-a	-	No
Hardware	cisco	ncs_540-6z18g-sys-d	-	No
Hardware	cisco	ncs_540-acc-sys	-	No
Hardware	cisco	ncs_540-fh-agg	-	No
Hardware	cisco	ncs_540-fh-csr-sys	-	No
Hardware	cisco	ncs_540x-12z16g-sys-a	-	No
Hardware	cisco	ncs_540x-12z16g-sys-d	-	No
Hardware	cisco	ncs_540x-16z4g8q2c-a	-	No
Hardware	cisco	ncs_540x-16z4g8q2c-d	-	No
Hardware	cisco	ncs_540x-16z8q2c-d	-	No
Hardware	cisco	ncs_540x-4z14g2q-a	-	No
Hardware	cisco	ncs_540x-4z14g2q-d	-	No
Hardware	cisco	ncs_540x-6z18g-sys-a	-	No
Hardware	cisco	ncs_540x-6z18g-sys-d	-	No
Hardware	cisco	ncs_540x-8z16g-sys-a	-	No
Hardware	cisco	ncs_540x-8z16g-sys-d	-	No
Hardware	cisco	ncs_540x-acc-sys	-	No
Hardware	cisco	ncs_5501	-	No
Hardware	cisco	ncs_5501-se	-	No
Hardware	cisco	ncs_5502	-	No
Hardware	cisco	ncs_5502-se	-	No
Hardware	cisco	ncs_5504	-	No
Hardware	cisco	ncs_5508	-	No
Hardware	cisco	ncs_5516	-	No
Hardware	cisco	ncs_55a1-24h	-	No
Hardware	cisco	ncs_55a1-24q6h-s	-	No
Hardware	cisco	ncs_55a1-24q6h-ss	-	No
Hardware	cisco	ncs_55a1-36h	-	No
Hardware	cisco	ncs_55a1-36h-se	-	No
Hardware	cisco	ncs_55a1-48q6h	-	No
Hardware	cisco	ncs_55a2-mod-hd-s	-	No
Hardware	cisco	ncs_55a2-mod-s	-	No
Hardware	cisco	ncs_55a2-mod-se-s	-	No
Hardware	cisco	ncs_560-4	-	No
Hardware	cisco	ncs_560-7	-	No
Hardware	cisco	ncs_57b1-5dse-sys	-	No
Hardware	cisco	ncs_57b1-6d24-sys	-	No
Hardware	cisco	ncs_57c1-48q6-sys	-	No
Hardware	cisco	ncs_57c3-mod-sys	-	No
Hardware	cisco	ncs_57d2-18dd-sys	-	No

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e Vendor Advisory ([email protected])
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For cisco's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.