CVE-2024-20303
Assigner: cisco
Published: 2024-03-27T17:00:37.075Z
State: PUBLISHED
descriptions: value: A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition.
 This vulnerability is due to improper management of mDNS client entries. An attacker could exploit this vulnerability by connecting to the wireless network and sending a continuous stream of specific mDNS packets. A successful exploit could allow the attacker to cause the wireless controller to have high CPU utilization, which could lead to access points (APs) losing their connection to the controller and result in a DoS condition.
affected: vendor: Cisco
product: Cisco IOS XE Software
versions: version: 17.2.1
status: affected
version: 17.2.1r
status: affected
version: 17.2.1a
status: affected
version: 17.2.1v
status: affected
version: 17.2.2
status: affected
version: 17.2.3
status: affected
version: 17.3.1
status: affected
version: 17.3.2
status: affected
version: 17.3.3
status: affected
version: 17.3.1a
status: affected
version: 17.3.1w
status: affected
version: 17.3.2a
status: affected
version: 17.3.1x
status: affected
version: 17.3.1z
status: affected
version: 17.3.4
status: affected
version: 17.3.5
status: affected
version: 17.3.4a
status: affected
version: 17.3.6
status: affected
version: 17.3.4b
status: affected
version: 17.3.4c
status: affected
version: 17.3.5a
status: affected
version: 17.3.5b
status: affected
version: 17.3.7
status: affected
version: 17.3.8
status: affected
version: 17.3.8a
status: affected
version: 17.4.1
status: affected
version: 17.4.2
status: affected
version: 17.4.1a
status: affected
version: 17.4.1b
status: affected
version: 17.4.2a
status: affected
version: 17.5.1
status: affected
version: 17.5.1a
status: affected
version: 17.6.1
status: affected
version: 17.6.2
status: affected
version: 17.6.1w
status: affected
version: 17.6.1a
status: affected
version: 17.6.1x
status: affected
version: 17.6.3
status: affected
version: 17.6.1y
status: affected
version: 17.6.1z
status: affected
version: 17.6.3a
status: affected
version: 17.6.4
status: affected
version: 17.6.1z1
status: affected
version: 17.6.5
status: affected
version: 17.6.5a
status: affected
version: 17.7.1
status: affected
version: 17.7.1a
status: affected
version: 17.7.1b
status: affected
version: 17.7.2
status: affected
version: 17.10.1
status: affected
version: 17.10.1a
status: affected
version: 17.10.1b
status: affected
version: 17.8.1
status: affected
version: 17.8.1a
status: affected
version: 17.9.1
status: affected
version: 17.9.1w
status: affected
version: 17.9.2
status: affected
version: 17.9.1a
status: affected
version: 17.9.1x
status: affected
version: 17.9.1y
status: affected
version: 17.9.3
status: affected
version: 17.9.2a
status: affected
version: 17.9.1x1
status: affected
version: 17.9.3a
status: affected
version: 17.9.1y1
status: affected
version: 17.11.1
status: affected
version: 17.11.1a
status: affected
version: 17.11.99SW
status: affected
problemTypes: descriptions: description: Incomplete Cleanup
type: cwe
cweId: CWE-459
metrics: format: cvssV3_1
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
baseScore: 7.4
baseSeverity: HIGH
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
source: advisory: cisco-sa-wlc-mdns-dos-4hv6pBGf
discovery: EXTERNAL
defects: CSCwf53124