CVE-2024-20309
Cisco Ios Xe 16.1.1 … 3.9.2s
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20309 is a medium-severity Signal Handler with Functionality that is not Asynchronous-Safe (CWE-828) vulnerability in Cisco Ios Xe. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18024
Vulnerability Data
A vulnerability in auxiliary asynchronous port (AUX) functions of Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload or stop responding. This vulnerability is due to the incorrect handling of specific ingress…
more
traffic when flow control hardware is enabled on the AUX port. An attacker could exploit this vulnerability by reverse telnetting to the AUX port and sending specific data after connecting. A successful exploit could allow the attacker to cause the device to reset or stop responding, resulting in a denial of service (DoS) condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, or code review) can locate signal handlers that invoke non-async-safe functions.
Requiring documented development standards and tools can mandate async-safe signal-handler implementations and ban unsafe library calls.
Engineering principles require reentrant and async-safe coding patterns that structurally avoid non-safe operations inside signal handlers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce use of async-signal-safe functions and reentrant handlers.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle requires safe coding practices that can prevent non-reentrant signal handlers.
Secure coding standards directly address asynchronous-safety and reentrancy requirements in signal handlers.
Security testing can detect unsafe signal handlers but does not prevent their introduction.