March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – Multiple Apache OFBiz and Superset Vulnerabilities
March 1, 2024
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
March 1, 2024
Rewterz Threat Advisory – Multiple Apache OFBiz and Superset Vulnerabilities
March 1, 2024
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
March 1, 2024
Severity
Medium
Analysis Summary
CVE-2024-20321 CVSS:8.6
Cisco NX-OS Software is vulnerable to a denial of service, caused by a flaw in the External Border Gateway Protocol (eBGP) implementation. By sending large amounts of network traffic with certain characteristics, a remote attacker could exploit this vulnerability to cause eBGP neighbor sessions to be dropped.
CVE-2024-20267 CVSS:8.6
Cisco NX-OS Software is vulnerable to a denial of service, caused by lack of proper error checking when processing an ingress MPLS frame. By sending a crafted IPv6 packet, a remote attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-20344 CVSS:5.3
Cisco UCS 6400 and 6500 Series Fabric Interconnects are vulnerable to a denial of service, caused by insufficient rate-limiting of TCP connections. By sending a high number of TCP packets, a remote attacker could exploit this vulnerability to cause the Device Console UI process to crash.
CVE-2024-20291 CVSS:5.8
Cisco Nexus 3000 and 9000 Series Switches could allow a remote attacker to bypass security restrictions, caused by incorrect hardware programming that occurs when configuration changes are made to port channel member ports. By sending a specially crafted request, an attacker could exploit this vulnerability to access network resources.
CVE-2024-20294 CVSS:6.6
Cisco FXOS and NX-OS Software is vulnerable to a denial of service, caused by improper handling of specific fields in an LLDP frame. By sending a crafted LLDP packet, a remote attacker could exploit this vulnerability to cause the LLDP service to crash.
Impact
- Denial of Service
- Security Bypass
Indicators Of Compromise
CVE
- CVE-2024-20321
- CVE-2024-20267
- CVE-2024-20344
- CVE-2024-20291
- CVE-2024-20294
Affected Vendors
Cisco
Affected Products
- Cisco Nexus 3000 Series Switches
- Cisco NX-OS Software
- Cisco UCS 6400 Series Fabric Interconnects
- Cisco Nexus 9000 Series Switches
- Cisco FXOS Software
- Cisco UCS 6500 Series Fabric Interconnects
Remediation
Refer to Cisco Security Advisory for patch, upgrade or suggested workaround information.