5.3
Medium
CVE-2024-20390 A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote…
Description
A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could exploit this vulnerability by sending a sustained, crafted stream of XML traffic to a targeted device. A successful exploit could allow the attacker to cause XML TCP port 38751 to become unreachable while the attack traffic persists.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco IOS XR Software | 24.2.1 | No fix stated |
| Cisco IOS XR Software | 24.1.1 | No fix stated |
| Cisco IOS XR Software 7.11 | 7.11.1 → 7.11.2 | No fix stated |
| Cisco IOS XR Software 7.10 | 7.10.1 → 7.10.2 | No fix stated |
| Cisco IOS XR Software 7.9 | 7.9.1 → 7.9.21 | No fix stated |
| Cisco IOS XR Software 7.8 | 7.8.1 → 7.8.22 | No fix stated |
| Cisco IOS XR Software 7.7 | 7.7.1 → 7.7.21 | No fix stated |
| Cisco IOS XR Software 7.6 | 7.6.1 → 7.6.15 | No fix stated |
| Cisco IOS XR Software 7.5 | 7.5.1 → 7.5.52 | No fix stated |
Show the 12 other branches Hide the 12 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco IOS XR Software 7.4 | 7.4.1 → 7.4.16 | No fix stated |
| Cisco IOS XR Software 7.3 | 7.3.1 → 7.3.27 | No fix stated |
| Cisco IOS XR Software 7.2 | 7.2.0 → 7.2.12 | No fix stated |
| Cisco IOS XR Software 7.1 | 7.1.1 → 7.1.25 | No fix stated |
| Cisco IOS XR Software 7.0 | 7.0.0 → 7.0.90 | No fix stated |
| Cisco IOS XR Software 6.9 | 6.9.1 → 6.9.2 | No fix stated |
| Cisco IOS XR Software 6.8 | 6.8.1 → 6.8.2 | No fix stated |
| Cisco IOS XR Software 6.7 | 6.7.1 → 6.7.35 | No fix stated |
| Cisco IOS XR Software 6.6 | 6.6.1 → 6.6.25 | No fix stated |
| Cisco IOS XR Software 6.5 | 6.5.1 → 6.5.93 | No fix stated |
| ios_xr_software | 24.2.1 | No fix stated |
| ios_xr_software 6.5 | 6.5.3 → 7.11.2 | No fix stated |
References
- cisco-sa-iosxr-xml-tcpdos-ZEXvrU2S sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco IOS XR Software
The 115 CVEs of Cisco IOS XR Software →
CVE-2026-76505
A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and…
7.5
High
CVE-2026-20278
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering…
8.8
High
CVE-2026-20280
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software…
8.8
High
CVE-2026-20279
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering…
9.8
Critical