Vulnerabilities > CVE-2024-20436 - NULL Pointer Dereference vulnerability in Cisco IOS XE

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

cisco

CWE-476

NVD

Published: 2024-09-25

Updated: 2024-10-08

Summary

A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a null pointer dereference when accessing specific URLs. An attacker could exploit this vulnerability by sending crafted HTTP traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, causing a DoS condition on the affected device.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS XE 3.13.2S Cisco IOS XE 3.10.6S Cisco IOS XE 3.13.6S Cisco IOS XE 3.14.4S Cisco IOS XE 3.15.1Cs Cisco IOS XE 3.13.4S Cisco IOS XE 16.2.1 Cisco IOS XE 3.13.0S Cisco IOS XE 3.17.3S Cisco IOS XE 3.16.0S Cisco IOS XE 3.14.1S Cisco IOS XE 3.12.2S Cisco IOS XE 3.10.5S Cisco IOS XE 3.10.8S Cisco IOS XE 3.9.0As Cisco IOS XE 3.10.1S Cisco IOS XE 3.10.2S Cisco IOS XE 3.18.2Asp Cisco IOS XE 3.16.2S Cisco IOS XE 3.9.2S Cisco IOS XE 3.16.0Cs Cisco IOS XE 3.13.5S Cisco IOS XE 3.11.2S Cisco IOS XE 3.15.0S Cisco IOS XE 3.14.3S Cisco IOS XE 16.6.1 Cisco IOS XE 3.17.4S Cisco IOS XE 3.17.2S Cisco IOS XE 3.11.3S Cisco IOS XE 3.15.3S Cisco IOS XE 3.10.2Ts Cisco IOS XE 3.10.3S Cisco IOS XE 3.16.6S Cisco IOS XE 3.14.0S Cisco IOS XE 3.16.5S Cisco IOS XE 3.10.7S Cisco IOS XE 3.11.0S Cisco IOS XE 3.9.1S Cisco IOS XE 3.15.1S Cisco IOS XE 3.10.0S Cisco IOS XE 3.17.0S Cisco IOS XE 3.16.4Ds Cisco IOS XE 3.16.3S Cisco IOS XE 3.17.1S Cisco IOS XE 3.15.2S Cisco IOS XE 3.10.8As Cisco IOS XE 16.4.1 Cisco IOS XE 3.14.2S Cisco IOS XE 3.15.4S Cisco IOS XE 3.16.1As Cisco IOS XE 3.12.0S Cisco IOS XE 3.12.1S Cisco IOS XE 3.12.4S Cisco IOS XE 16.2.2 Cisco IOS XE 3.16.4As Cisco IOS XE 3.13.3S Cisco IOS XE 3.13.6As Cisco IOS XE 3.16.4Bs Cisco IOS XE 3.11.4S Cisco IOS XE 3.12.3S Cisco IOS XE 16.3.1 Cisco IOS XE 3.13.1S Cisco IOS XE 3.10.4S Cisco IOS XE 3.11.1S Cisco IOS XE 3.13.8S Cisco IOS XE 16.3.1A Cisco IOS XE 16.3.2 Cisco IOS XE 16.3.3 Cisco IOS XE 3.16.6Bs Cisco IOS XE 16.5.1 Cisco IOS XE 3.13.7S Cisco IOS XE 3.10.9S Cisco IOS XE 16.3.4 Cisco IOS XE 16.5.1B Cisco IOS XE 16.4.2 Cisco IOS XE 3.13.9S Cisco IOS XE 16.3.6 Cisco IOS XE 16.6.3 Cisco IOS XE 16.8.1 Cisco IOS XE 16.7.1 Cisco IOS XE 16.6.2 Cisco IOS XE 16.9.1 Cisco IOS XE 16.3.5 Cisco IOS XE 16.5.2 Cisco IOS XE 16.8.1S Cisco IOS XE 16.8.2 Cisco IOS XE 16.7.2 Cisco IOS XE 16.7.3 Cisco IOS XE 16.4.3 Cisco IOS XE 16.9.1S Cisco IOS XE 3.16.7As Cisco IOS XE 3.16.7S Cisco IOS XE 3.16.7Bs Cisco IOS XE 16.5.3 Cisco IOS XE 16.3.7 Cisco IOS XE 16.3.8 Cisco IOS XE 3.13.10S Cisco IOS XE 3.10.10S Cisco IOS XE 16.6.4 Cisco IOS XE 3.16.8S Cisco IOS XE 16.10.1 Cisco IOS XE 16.9.2 Cisco IOS XE 3.16.10S Cisco IOS XE 16.12.1 Cisco IOS XE 16.6.5 Cisco IOS XE 16.11.1 Cisco IOS XE 17.1.1 Cisco IOS XE 16.11.1A Cisco IOS XE 16.12.1C Cisco IOS XE 16.11.2 Cisco IOS XE 16.12.1S Cisco IOS XE 16.12.1A Cisco IOS XE 16.11.1B Cisco IOS XE 16.11.1S Cisco IOS XE 16.10.1S Cisco IOS XE 3.16.9S Cisco IOS XE 16.6.6 Cisco IOS XE 16.3.9 Cisco IOS XE 16.10.1A Cisco IOS XE 16.10.2 Cisco IOS XE 16.9.3 Cisco IOS XE 16.10.1E Cisco IOS XE 16.10.1B Cisco IOS XE 16.8.3 Cisco IOS XE 16.9.4 Cisco IOS XE 16.12.2 Cisco IOS XE 16.6.7 Cisco IOS XE 16.10.3 Cisco IOS XE 16.12.4 Cisco IOS XE 16.12.8 Cisco IOS XE 16.3.10 Cisco IOS XE 16.9.5 Cisco IOS XE 16.6.8 Cisco IOS XE 16.12.3 Cisco IOS XE 17.2.1 Cisco IOS XE 17.4.1 Cisco IOS XE 16.6.9 Cisco IOS XE 17.1.1S Cisco IOS XE 16.12.2S Cisco IOS XE 17.1.1T Cisco IOS XE 16.3.11 Cisco IOS XE 17.2.1V Cisco IOS XE 16.12.3S Cisco IOS XE 17.2.1R Cisco IOS XE 16.12.4A Cisco IOS XE 17.1.3 Cisco IOS XE 17.2.2 Cisco IOS XE 17.3.1 Cisco IOS XE 17.4.1A Cisco IOS XE 17.3.2 Cisco IOS XE 17.4.1B Cisco IOS XE 17.3.1A Cisco IOS XE 17.2.3 Cisco IOS XE 16.9.6 Cisco IOS XE 16.12.5 Cisco IOS XE 17.5.1 Cisco IOS XE 17.3.3 Cisco IOS XE 16.9.7 Cisco IOS XE 17.5.1A Cisco IOS XE 17.6.1 Cisco IOS XE 17.3.4A Cisco IOS XE 17.4.2 Cisco IOS XE 17.6.1A Cisco IOS XE 16.6.10 Cisco IOS XE 16.9.8 Cisco IOS XE 17.3.4 Cisco IOS XE 16.12.6 Cisco IOS XE 17.6.3 Cisco IOS XE 17.9.1 Cisco IOS XE 16.12.7 Cisco IOS XE 17.3.5 Cisco IOS XE 17.6.2 Cisco IOS XE 17.6.3A Cisco IOS XE 17.7.1 Cisco IOS XE 17.7.1A Cisco IOS XE 17.7.2 Cisco IOS XE 17.8.1 Cisco IOS XE 17.8.1A Cisco IOS XE 17.11.1 Cisco IOS XE 17.10.1 Cisco IOS XE 17.3.6 Cisco IOS XE 17.6.4 Cisco IOS XE 17.9.1A Cisco IOS XE 17.3.7 Cisco IOS XE 17.6.5 Cisco IOS XE 17.10.1A Cisco IOS XE 17.10.1B Cisco IOS XE 17.9.2 Cisco IOS XE 17.9.3 Cisco IOS XE 17.9.2A Cisco IOS XE 17.9.3A Cisco IOS XE 17.11.1A Cisco IOS XE 17.6.5A Cisco IOS XE 17.12.1A Cisco IOS XE 17.12.1 Cisco IOS XE 17.9.4A Cisco IOS XE 17.9.4 Cisco IOS XE 17.6.6A Cisco IOS XE 17.6.6 Cisco IOS XE 17.3.8A Cisco IOS XE 17.3.8	201

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-httpsrvr-dos-yOZThut