CVE-2024-20390

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could exploit this vulnerability by sending a sustained, crafted stream of XML traffic to a targeted device. A successful exploit could allow the attacker to cause XML TCP port 38751 to become unreachable while the attack traffic persists.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-940

Affected software

VendorProductVersions
CiscoCisco IOS XR Software6.5.3; 6.5.29; 6.5.1; 6.6.1; 6.5.2; 6.5.92; 6.5.15; 6.6.2; 7.0.1; 6.6.25; 6.5.26; 6.6.11; 6.5.25; 6.5.28; 6.5.93; 6.6.12; 6.5.90; 7.0.0; 7.1.1; 7.0.90
ciscoios_xr_software>= 6.5.3, <= 7.11.2; 24.2.1

References

Timeline

Published
Sep 11, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-203916.8A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical acceCVE-2024-203926.1A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remCVE-2024-203938.8A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers CVE-2024-203945.5A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DCVE-2024-203957.3A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to CVE-2024-203966.5A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive infoCVE-2024-203975.2A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected deviceCVE-2024-203987.8A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on CVE-2024-203996.7A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute aCVE-2024-20404.3The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private grouCVE-2024-204004.7A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirectCVE-2024-204019.8A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote
CVE-2024-20390: Medium severity, CVSS 5.3 | Vulnix