Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
0

CVE-2024-20263

Disclosure Date: January 26, 2024 •
CVE-2024-20263 CVSS v3 Base Score: 7.2
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart Switches and Business 350 Series Managed Switches could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. This vulnerability is due to incorrect processing of ACLs on a stacked configuration when either the primary or backup switches experience a full stack reload or power cycle. An attacker could exploit this vulnerability by sending crafted traffic through an affected device. A successful exploit could allow the attacker to bypass configured ACLs, causing traffic to be dropped or forwarded in an unexpected manner. The attacker does not have control over the conditions that result in the device being in the vulnerable state. Note: In the vulnerable state, the ACL would be correctly applied on the primary devices but could be incorrectly applied to the backup devices.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
7.2 High
Impact Score:
2.7
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Changed
Confidentiality (C):
None
Integrity (I):
Low
Availability (A):
Low

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
Cisco Small Business Smart and Managed Switches 2.0.0.73
Cisco Small Business Smart and Managed Switches 2.1.0.63
Cisco Small Business Smart and Managed Switches 2.2.0.63
Cisco Small Business Smart and Managed Switches 2.2.0.66
Cisco Small Business Smart and Managed Switches 2.2.5.68
Cisco Small Business Smart and Managed Switches 2.2.7.07
Cisco Small Business Smart and Managed Switches 2.2.8.04
Cisco Small Business Smart and Managed Switches 2.3.0.130
Cisco Small Business Smart and Managed Switches 2.3.5.63
Cisco Small Business Smart and Managed Switches 2.4.0.91
Cisco Small Business Smart and Managed Switches 2.4.0.94
Cisco Small Business Smart and Managed Switches 2.4.5.71
Cisco Small Business Smart and Managed Switches 2.5.0.78
Cisco Small Business Smart and Managed Switches 2.5.0.79
Cisco Small Business Smart and Managed Switches 2.5.0.82
Cisco Small Business Smart and Managed Switches 2.5.0.83
Cisco Small Business Smart and Managed Switches 2.5.0.89
Cisco Small Business Smart and Managed Switches 2.5.0.90
Cisco Small Business Smart and Managed Switches 2.5.0.92
Cisco Small Business Smart and Managed Switches 2.5.5.47
Cisco Small Business Smart and Managed Switches 2.5.7.85
Cisco Small Business Smart and Managed Switches 2.5.8.12
Cisco Small Business Smart and Managed Switches 2.5.8.15
Cisco Small Business Smart and Managed Switches 2.5.9.13
Cisco Small Business Smart and Managed Switches 2.5.9.15
Cisco Small Business Smart and Managed Switches 2.5.9.16
Cisco Small Business Smart and Managed Switches 3.0.0.61
Cisco Small Business Smart and Managed Switches 3.0.0.69
Cisco Small Business Smart and Managed Switches 3.1.0.57
Cisco Small Business Smart and Managed Switches 3.1.1.7
Cisco Small Business Smart and Managed Switches 3.2.0.84
Cisco Small Business Smart and Managed Switches 3.2.0.89
Cisco Small Business Smart and Managed Switches 3.2.1.1
Cisco Small Business Smart and Managed Switches 3.3.0.16
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

Products

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis