CVE-2024-20316

Cisco Ios Xe 16.10.1 … 17.9.4a

Published

27 March 2024

Modified

17 June 2026

Patch / advisory

View advisory

CVSS Score v3.1 5.8

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

EPSS Score 0.0045 38th percentile

Risk Priority 46 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-20316 is a medium-severity Detection of Error Condition Without Action (CWE-390) vulnerability in Cisco Ios Xe. Its CVSS base score is 5.8 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-18031

Vulnerability Data

A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access resources that should have been protected by a configured IPv4 access control list (ACL). This vulnerability is due…

to improper handling of error conditions when a successfully authorized device administrator updates an IPv4 ACL using the NETCONF or RESTCONF protocol, and the update would reorder access control entries (ACEs) in the updated ACL. An attacker could exploit this vulnerability by accessing resources that should have been protected across an affected device.

CWE(s): CWE-390

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.001 LSASS Memory Credential Access

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

attack.mitre.org →

T1003.002 Security Account Manager Credential Access

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.

attack.mitre.org →

T1014 Rootkit Stealth

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

attack.mitre.org →

T1016 System Network Configuration Discovery Discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

attack.mitre.org →

T1016.001 Internet Connection Discovery Discovery

Adversaries may check for Internet connectivity on compromised systems.

attack.mitre.org →

T1016.002 Wi-Fi Discovery Discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-20124Same product: Cisco Ios Xe

CVE-2024-20309Same product: Cisco Ios Xe

CVE-2024-20480Same product: Cisco Ios Xe

CVE-2024-20314Same product: Cisco Ios Xe

CVE-2026-20004Same product: Cisco Ios Xe

CVE-2024-20313Same product: Cisco Ios Xe

CVE-2026-20104Same product: Cisco Ios Xe

CVE-2025-20315Same product: Cisco Ios Xe

CVE-2025-20202Same product: Cisco Ios Xe

CVE-2024-20437Same product: Cisco Ios Xe

Affected Assets

cisco

ios xe

16.10.1, 16.10.1a, 16.10.1b, 16.10.1e, 16.10.1s

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation will surface code paths that detect errors yet perform no subsequent action.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.AE-02 partial match

blocks

Analysis of detected events directly counters ignoring them, but does not guarantee every error condition is covered.

DE.AE-08 partial match

blocks

Declaring incidents when criteria are met forces action on detected errors; eliminating the weakness helps but does not define the criteria themselves.

DE.CM-09 partial match

blocks

Monitoring produces detections, yet supplies no requirement to act on them.

PR.PS-04 partial match

blocks

Generating logs enables later action but does not enforce handling of each error condition.

RS.AN-03 partial match

blocks

Root-cause analysis of incidents requires acting on detected anomalies, though it applies after an incident is already declared.

RS.MA-02 partial match

blocks

Triaging and validating reports compels follow-up on detections; removing the weakness supports but does not replace triage processes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging partial match

finds

Logging captures error conditions but does not guarantee subsequent handling or remediation.

A.8.16 Monitoring activities partial match

finds

Monitoring activities can detect errors, yet without defined response procedures the weakness persists.

A.8.19 Installation of software on operational systems partial match

removes

A.8.25 Secure development life cycle partial match

blocks

Secure development lifecycle practices encourage proper error handling, but do not mandate it for every detected condition.

A.8.26 Application security requirements partial match