{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20278", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2023-11-08T15:08:07.625Z", "datePublished": "2024-03-27T16:59:12.963Z", "dateUpdated": "2024-08-15T16:45:09.481Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-03-27T16:59:12.963Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\r\n\r This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root."}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"version": "17.6.1", "status": "affected"}, {"version": "17.6.2", "status": "affected"}, {"version": "17.6.1w", "status": "affected"}, {"version": "17.6.1a", "status": "affected"}, {"version": "17.6.1x", "status": "affected"}, {"version": "17.6.3", "status": "affected"}, {"version": "17.6.1y", "status": "affected"}, {"version": "17.6.1z", "status": "affected"}, {"version": "17.6.3a", "status": "affected"}, {"version": "17.6.4", "status": "affected"}, {"version": "17.6.1z1", "status": "affected"}, {"version": "17.6.5", "status": "affected"}, {"version": "17.6.6", "status": "affected"}, {"version": "17.6.6a", "status": "affected"}, {"version": "17.6.5a", "status": "affected"}, {"version": "17.7.1", "status": "affected"}, {"version": "17.7.1a", "status": "affected"}, {"version": "17.7.1b", "status": "affected"}, {"version": "17.7.2", "status": "affected"}, {"version": "17.10.1", "status": "affected"}, {"version": "17.10.1a", "status": "affected"}, {"version": "17.10.1b", "status": "affected"}, {"version": "17.8.1", "status": "affected"}, {"version": "17.8.1a", "status": "affected"}, {"version": "17.9.1", "status": "affected"}, {"version": "17.9.1w", "status": "affected"}, {"version": "17.9.2", "status": "affected"}, {"version": "17.9.1a", "status": "affected"}, {"version": "17.9.1x", "status": "affected"}, {"version": "17.9.1y", "status": "affected"}, {"version": "17.9.3", "status": "affected"}, {"version": "17.9.2a", "status": "affected"}, {"version": "17.9.1x1", "status": "affected"}, {"version": "17.9.3a", "status": "affected"}, {"version": "17.9.4", "status": "affected"}, {"version": "17.9.1y1", "status": "affected"}, {"version": "17.9.4a", "status": "affected"}, {"version": "17.11.1", "status": "affected"}, {"version": "17.11.1a", "status": "affected"}, {"version": "17.12.1", "status": "affected"}, {"version": "17.12.1w", "status": "affected"}, {"version": "17.12.1a", "status": "affected"}, {"version": "17.11.99SW", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incomplete List of Disallowed Inputs", "type": "cwe", "cweId": "CWE-184"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX", "name": "cisco-sa-iosxe-priv-esc-seAx6NLX"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-iosxe-priv-esc-seAx6NLX", "discovery": "INTERNAL", "defects": ["CSCwf91143"]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:41.100Z"}, "title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX", "name": "cisco-sa-iosxe-priv-esc-seAx6NLX", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "cisco", "product": "ios_xe", "cpes": ["cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1x:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1y:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1z:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.3a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1z1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.6:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.6a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.5a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1b:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.8.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.3a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1y1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "17.6.1", "status": "affected"}, {"version": "17.6.2", "status": "affected"}, {"version": "17.6.1w", "status": "affected"}, {"version": "17.6.1a", "status": "affected"}, {"version": "17.6.1x", "status": "affected"}, {"version": "17.6.3", "status": "affected"}, {"version": "17.6.1y", "status": "affected"}, {"version": "17.6.1z", "status": "affected"}, {"version": "17.6.3a", "status": "affected"}, {"version": "17.6.4", "status": "affected"}, {"version": "17.6.1z1", "status": "affected"}, {"version": "17.6.5", "status": "affected"}, {"version": "17.6.6", "status": "affected"}, {"version": "17.6.6a", "status": "affected"}, {"version": "17.6.5a", "status": "affected"}, {"version": "17.7.1", "status": "affected"}, {"version": "17.7.1a", "status": "affected"}, {"version": "17.7.1b", "status": "affected"}, {"version": "17.7.2", "status": "affected"}, {"version": "17.10.1", "status": "affected"}, {"version": "17.10.1a", "status": "affected"}, {"version": "17.10.1b", "status": "affected"}, {"version": "17.8.1", "status": "affected"}, {"version": "17.8.1a", "status": "affected"}, {"version": "17.9.1", "status": "affected"}, {"version": "17.9.1w", "status": "affected"}, {"version": "17.9.2", "status": "affected"}, {"version": "17.9.1a", "status": "affected"}, {"version": "17.9.1x", "status": "affected"}, {"version": "17.9.1y", "status": "affected"}, {"version": "17.9.3", "status": "affected"}, {"version": "17.9.2a", "status": "affected"}, {"version": "17.9.1x1", "status": "affected"}, {"version": "17.9.3a", "status": "affected"}, {"version": "17.9.4", "status": "affected"}, {"version": "17.9.1y1", "status": "affected"}, {"version": "17.9.4a", "status": "affected"}, {"version": "17.11.1", "status": "affected"}, {"version": "17.11.1a", "status": "affected"}, {"version": "17.12.1", "status": "affected"}, {"version": "17.12.1w", "status": "affected"}, {"version": "17.12.1a", "status": "affected"}, {"version": "17.11.99sw", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-28T04:00:40.599661Z", "id": "CVE-2024-20278", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T16:45:09.481Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX", "name": "cisco-sa-iosxe-priv-esc-seAx6NLX", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:41.100Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20278", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-28T04:00:40.599661Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1x:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1y:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1z:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.3a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.1z1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.5:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.6:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.6a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.6.5a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.1b:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.7.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.8.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.3:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.3a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.1y1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*"], "vendor": "cisco", "product": "ios_xe", "versions": [{"status": "affected", "version": "17.6.1"}, {"status": "affected", "version": "17.6.2"}, {"status": "affected", "version": "17.6.1w"}, {"status": "affected", "version": "17.6.1a"}, {"status": "affected", "version": "17.6.1x"}, {"status": "affected", "version": "17.6.3"}, {"status": "affected", "version": "17.6.1y"}, {"status": "affected", "version": "17.6.1z"}, {"status": "affected", "version": "17.6.3a"}, {"status": "affected", "version": "17.6.4"}, {"status": "affected", "version": "17.6.1z1"}, {"status": "affected", "version": "17.6.5"}, {"status": "affected", "version": "17.6.6"}, {"status": "affected", "version": "17.6.6a"}, {"status": "affected", "version": "17.6.5a"}, {"status": "affected", "version": "17.7.1"}, {"status": "affected", "version": "17.7.1a"}, {"status": "affected", "version": "17.7.1b"}, {"status": "affected", "version": "17.7.2"}, {"status": "affected", "version": "17.10.1"}, {"status": "affected", "version": "17.10.1a"}, {"status": "affected", "version": "17.10.1b"}, {"status": "affected", "version": "17.8.1"}, {"status": "affected", "version": "17.8.1a"}, {"status": "affected", "version": "17.9.1"}, {"status": "affected", "version": "17.9.1w"}, {"status": "affected", "version": "17.9.2"}, {"status": "affected", "version": "17.9.1a"}, {"status": "affected", "version": "17.9.1x"}, {"status": "affected", "version": "17.9.1y"}, {"status": "affected", "version": "17.9.3"}, {"status": "affected", "version": "17.9.2a"}, {"status": "affected", "version": "17.9.1x1"}, {"status": "affected", "version": "17.9.3a"}, {"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.9.1y1"}, {"status": "affected", "version": "17.9.4a"}, {"status": "affected", "version": "17.11.1"}, {"status": "affected", "version": "17.11.1a"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.1w"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.11.99sw"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T16:40:09.774Z"}}], "cna": {"source": {"defects": ["CSCwf91143"], "advisory": "cisco-sa-iosxe-priv-esc-seAx6NLX", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"status": "affected", "version": "17.6.1"}, {"status": "affected", "version": "17.6.2"}, {"status": "affected", "version": "17.6.1w"}, {"status": "affected", "version": "17.6.1a"}, {"status": "affected", "version": "17.6.1x"}, {"status": "affected", "version": "17.6.3"}, {"status": "affected", "version": "17.6.1y"}, {"status": "affected", "version": "17.6.1z"}, {"status": "affected", "version": "17.6.3a"}, {"status": "affected", "version": "17.6.4"}, {"status": "affected", "version": "17.6.1z1"}, {"status": "affected", "version": "17.6.5"}, {"status": "affected", "version": "17.6.6"}, {"status": "affected", "version": "17.6.6a"}, {"status": "affected", "version": "17.6.5a"}, {"status": "affected", "version": "17.7.1"}, {"status": "affected", "version": "17.7.1a"}, {"status": "affected", "version": "17.7.1b"}, {"status": "affected", "version": "17.7.2"}, {"status": "affected", "version": "17.10.1"}, {"status": "affected", "version": "17.10.1a"}, {"status": "affected", "version": "17.10.1b"}, {"status": "affected", "version": "17.8.1"}, {"status": "affected", "version": "17.8.1a"}, {"status": "affected", "version": "17.9.1"}, {"status": "affected", "version": "17.9.1w"}, {"status": "affected", "version": "17.9.2"}, {"status": "affected", "version": "17.9.1a"}, {"status": "affected", "version": "17.9.1x"}, {"status": "affected", "version": "17.9.1y"}, {"status": "affected", "version": "17.9.3"}, {"status": "affected", "version": "17.9.2a"}, {"status": "affected", "version": "17.9.1x1"}, {"status": "affected", "version": "17.9.3a"}, {"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.9.1y1"}, {"status": "affected", "version": "17.9.4a"}, {"status": "affected", "version": "17.11.1"}, {"status": "affected", "version": "17.11.1a"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.1w"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.11.99SW"}]}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX", "name": "cisco-sa-iosxe-priv-esc-seAx6NLX"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\r\n\r This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-184", "description": "Incomplete List of Disallowed Inputs"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-03-27T16:59:12.963Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20278", "state": "PUBLISHED", "dateUpdated": "2024-08-15T16:45:09.481Z", "dateReserved": "2023-11-08T15:08:07.625Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-03-27T16:59:12.963Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "4DE62C4B-7C06-4907-BADE-416C1618D2D9", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1a:*:*:*:*:*:*:*", "matchCriteriaId": "0C60DF3F-DBD9-4BBF-812E-4BB0C47BDF3C", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1w:*:*:*:*:*:*:*", "matchCriteriaId": "26FEE2E2-DD85-4006-8895-0BDA04E8EE4C", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1x:*:*:*:*:*:*:*", "matchCriteriaId": "A0CD237B-2843-4D37-87D7-AE6D1A53458A", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1y:*:*:*:*:*:*:*", "matchCriteriaId": "1B80614B-6362-45F0-B305-2F137B053DCF", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1z:*:*:*:*:*:*:*", "matchCriteriaId": "47B20C7E-1C9C-4EF4-91E4-388643C4B9C0", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.1z1:*:*:*:*:*:*:*", "matchCriteriaId": "EB7966A0-D84D-47F7-AED9-D041BCDA6703", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "04D19D8C-FACF-49B4-BA99-CC3A3FDADAFB", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "0B78942C-BEE1-4D18-9075-8E1D991BF621", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.3a:*:*:*:*:*:*:*", "matchCriteriaId": "5B306D35-4A13-4D23-8EC2-D000E8ADCDA5", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.4:*:*:*:*:*:*:*", "matchCriteriaId": "9F21093D-1036-4F6B-B90F-ACE1EF99EA33", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.5:*:*:*:*:*:*:*", "matchCriteriaId": "280D24C6-A2BF-46E8-B512-6A3FA7833922", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.5a:*:*:*:*:*:*:*", "matchCriteriaId": "1F903F51-ABF4-49B0-A5BA-A6B51F79666F", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.6:*:*:*:*:*:*:*", "matchCriteriaId": "E3F244E7-8EE9-4E58-83FA-EEDD3C8F792D", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.6a:*:*:*:*:*:*:*", "matchCriteriaId": "5238B1D1-740D-4B37-A0CB-1B3343E55D05", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "38B87B17-C653-40AC-8AE4-066BB1123C88", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.7.1a:*:*:*:*:*:*:*", "matchCriteriaId": "9012A66E-82C4-4ACF-A4BB-37EC54B87B50", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.7.1b:*:*:*:*:*:*:*", "matchCriteriaId": "9C945710-7DC3-43D9-9FBE-F2A1B8666C73", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "849C6FF1-F7C0-4021-BCA2-A791C87E4F37", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "7592C7E3-3735-425F-A276-9EE03224CD5E", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.8.1a:*:*:*:*:*:*:*", "matchCriteriaId": "1103BE75-EB64-4A9A-801E-EDE6A1F861F5", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "5B0C2129-8149-4362-827C-A5494C9D398B", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*", "matchCriteriaId": "7452C7E9-6241-42C5-9A7F-13C0BD38A2B4", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*", "matchCriteriaId": "38C48FC4-5362-4B61-8B8C-7CAFFB81045E", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*", "matchCriteriaId": "2BC43383-DF99-4D38-A220-0A202623B36A", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*", "matchCriteriaId": "B7E6CD08-EC7E-42C1-B2C2-CA5E154545A0", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*", "matchCriteriaId": "DE62DC68-E882-49E7-AAD2-2F73637FFB4A", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.1y1:*:*:*:*:*:*:*", "matchCriteriaId": "57CD29C9-C629-48B0-ABDD-CEC3DEB6FB11", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*", "matchCriteriaId": "D197445E-EC12-429C-BDD4-F63FA5C1B3E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*", "matchCriteriaId": "BD27DF50-9E81-4EC5-BA73-513F1DFB972C", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "51EA3EAA-A379-467E-AF9A-FCFBACAE49C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.3a:*:*:*:*:*:*:*", "matchCriteriaId": "4FC63AAF-758F-4A70-9738-96E75A0A1DDA", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*", "matchCriteriaId": "E67BE408-8DCF-491F-9EA9-E368565C1B49", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*", "matchCriteriaId": "D9CFE98A-FBA5-4837-BBD9-3C875ECEBF1B", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*", "matchCriteriaId": "42FAEC29-D754-49D6-85F1-F5DDFAF6E80F", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*", "matchCriteriaId": "CCE76032-948F-444F-BA5D-72A34D1CD382", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*", "matchCriteriaId": "9A965A2A-129C-45C3-BCB1-2860F583D020", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*", "matchCriteriaId": "F313F2EC-F3D6-4639-934C-402DDA3DA806", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.11.1a:*:*:*:*:*:*:*", "matchCriteriaId": "4AFB2CA6-8332-4E4D-BDB4-C3B770D3AD6C", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*", "matchCriteriaId": "6F7C157F-5569-4072-805F-7AF598F6B56F", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*", "matchCriteriaId": "1BF0778B-015D-481B-BAC0-40667F3453D3", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*", "matchCriteriaId": "1EEBC0EB-0DBB-4530-AFC4-AA0036469656", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1w:*:*:*:*:*:*:*", "matchCriteriaId": "66D0DB87-6BB7-4FCF-BF20-6D4D48D72B79", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device.\r\n\r This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n NETCONF del software Cisco IOS XE podr\u00eda permitir que un atacante remoto autenticado eleve los privilegios a root en un dispositivo afectado. Esta vulnerabilidad se debe a una validaci\u00f3n inadecuada de la entrada proporcionada por el usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando informaci\u00f3n manipulada a trav\u00e9s de NETCONF a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante elevar los privilegios de Administrador a Root."}], "id": "CVE-2024-20278", "lastModified": "2025-08-01T15:22:56.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "[email protected]", "type": "Secondary"}]}, "published": "2024-03-27T17:15:51.703", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}], "source": "[email protected]", "type": "Secondary"}]}

{}