CVE-2024-20327

A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of malformed PPPoE packets that are received on a router that is running Broadband Network Gateway (BNG) functionality with PPPoE termination on a Lightspeed-based or Lightspeed-Plus-based line card. An attacker could exploit this vulnerability by sending a crafted PPPoE packet to an affected line card interface that does not terminate PPPoE. A successful exploit could allow the attacker to crash the ppp_ma process, resulting in a DoS condition for PPPoE traffic across the router.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW	Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:cisco:ios_xr::::::::
	cpe:2.3:o:cisco:ios_xr::::::::
	cpe:2.3:o:cisco:ios_xr::::::::

OR	cpe:2.3:h:cisco:asr_9000v-v2:-:::::::*
	cpe:2.3:h:cisco:asr_9001:-:::::::*
	cpe:2.3:h:cisco:asr_9006:-:::::::*
	cpe:2.3:h:cisco:asr_9010:-:::::::*
	cpe:2.3:h:cisco:asr_9901:-:::::::*
	cpe:2.3:h:cisco:asr_9902:-:::::::*
	cpe:2.3:h:cisco:asr_9903:-:::::::*
	cpe:2.3:h:cisco:asr_9904:-:::::::*
	cpe:2.3:h:cisco:asr_9906:-:::::::*
	cpe:2.3:h:cisco:asr_9910:-:::::::*
	cpe:2.3:h:cisco:asr_9912:-:::::::*
	cpe:2.3:h:cisco:asr_9922:-:::::::*

History

06 May 2025, 17:11

Type	Values Removed	Values Added
First Time		Cisco asr 9922 Cisco asr 9904 Cisco asr 9010 Cisco ios Xr Cisco asr 9901 Cisco asr 9910 Cisco asr 9903 Cisco asr 9001 Cisco asr 9906 Cisco asr 9912 Cisco Cisco asr 9902 Cisco asr 9006 Cisco asr 9000v-v2
CWE		NVD-CWE-Other
CPE		cpe:2.3:h:cisco:asr_9000v-v2:-:::::::* cpe:2.3:h:cisco:asr_9906:-:::::::* cpe:2.3:h:cisco:asr_9006:-:::::::* cpe:2.3:h:cisco:asr_9903:-:::::::* cpe:2.3:h:cisco:asr_9912:-:::::::* cpe:2.3:h:cisco:asr_9902:-:::::::* cpe:2.3:h:cisco:asr_9001:-:::::::* cpe:2.3:o:cisco:ios_xr:::::::: cpe:2.3:h:cisco:asr_9901:-:::::::* cpe:2.3:h:cisco:asr_9010:-:::::::* cpe:2.3:h:cisco:asr_9910:-:::::::* cpe:2.3:h:cisco:asr_9904:-:::::::* cpe:2.3:h:cisco:asr_9922:-:::::::*
References	~~() https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW -~~	() https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW - Vendor Advisory

21 Nov 2024, 08:52

Type	Values Removed	Values Added
References	~~() https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW -~~	() https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW -

13 Mar 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-13 17:15

Updated : 2025-05-06 17:11

NVD link : CVE-2024-20327

Mitre link : CVE-2024-20327

CVE.ORG link : CVE-2024-20327

JSON object : View

Products Affected

cisco

asr_9904
asr_9903
ios_xr
asr_9910
asr_9001
asr_9000v-v2
asr_9912
asr_9901
asr_9906
asr_9010
asr_9006
asr_9922
asr_9902

CWE

CWE-20

Improper Input Validation

NVD-CWE-Other

{"id": "CVE-2024-20327", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "published": "2024-03-13T17:15:48.593", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}, {"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service (DoS) condition.\r\n\r This vulnerability is due to the improper handling of malformed PPPoE packets that are received on a router that is running Broadband Network Gateway (BNG) functionality with PPPoE termination on a Lightspeed-based or Lightspeed-Plus-based line card. An attacker could exploit this vulnerability by sending a crafted PPPoE packet to an affected line card interface that does not terminate PPPoE. A successful exploit could allow the attacker to crash the ppp_ma process, resulting in a DoS condition for PPPoE traffic across the router."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n de terminaci\u00f3n de PPP sobre Ethernet (PPPoE) del software Cisco IOS XR para los enrutadores de servicios de agregaci\u00f3n Cisco ASR serie 9000 podr\u00eda permitir que un atacante adyacente no autenticado bloquee el proceso ppp_ma, lo que resultar\u00eda en una condici\u00f3n de denegaci\u00f3n de servicio (DoS). Esta vulnerabilidad se debe al manejo inadecuado de paquetes PPPoE con formato incorrecto que se reciben en un enrutador que ejecuta la funcionalidad Broadband Network Gateway (BNG) con terminaci\u00f3n PPPoE en una tarjeta de l\u00ednea basada en Lightspeed o Lightspeed-Plus. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando un paquete PPPoE manipulado a una interfaz de tarjeta de l\u00ednea afectada que no termine PPPoE. Un exploit exitoso podr\u00eda permitir al atacante bloquear el proceso ppp_ma, lo que resultar\u00eda en una condici\u00f3n DoS para el tr\u00e1fico PPPoE a trav\u00e9s del enrutador."}], "lastModified": "2025-05-06T17:11:55.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35FF3D39-F038-40C0-B1AE-DE3F400233A0", "versionEndExcluding": "7.9.21"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79D64289-BE44-48B6-931A-917B28E81DAE", "versionEndExcluding": "7.10.1", "versionStartIncluding": "7.10"}, {"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3DE63546-5EA3-4FAD-A878-CF51024E6469", "versionEndExcluding": "7.11.1", "versionStartIncluding": "7.11"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:asr_9000v-v2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DB91BE23-C710-473F-8E43-0E0DE760F8AD"}, {"criteria": "cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "324C97E6-1810-404F-9F45-6240F99FF039"}, {"criteria": "cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "57EB55BB-41B7-40A1-B6F5-142FE8AB4C16"}, {"criteria": "cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "433F4A82-04A4-4EAA-8C19-F7581DCD8D29"}, {"criteria": "cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2D5E60AB-94FF-448A-89D8-5D2197E21C74"}, {"criteria": "cpe:2.3:h:cisco:asr_9902:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "91474DBC-FB31-4DDF-96C5-311FA1D53A74"}, {"criteria": "cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FA241214-2F05-4360-9B50-385355E29CF4"}, {"criteria": "cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A93212A4-50AB-42E7-89A4-5FBBAEA050C3"}, {"criteria": "cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EDA53A61-98B3-458C-8893-61CD7D6B1E48"}, {"criteria": "cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F396564E-B477-4A27-A189-CEB737552E25"}, {"criteria": "cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5445CC54-ACFB-4070-AF26-F91FEAA85181"}, {"criteria": "cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D7AA58E5-D7E1-48CF-93FF-C60EB85B2BC7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@cisco.com"}

7.4 /10