CVE-2024-20317
Cisco Ios Xr 7.10.1 … 7.9.21
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20317 is a high-severity Incorrect Provision of Specified Functionality (CWE-684) vulnerability in Cisco Ios Xr. Its CVSS base score is 7.4 (High).
Operationally, ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18032
Vulnerability Data
A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a denial…
more
of service (DoS) condition. This vulnerability is due to incorrect classification of certain types of Ethernet frames that are received on an interface. An attacker could exploit this vulnerability by sending specific types of Ethernet frames to or through the affected device. A successful exploit could allow the attacker to cause control plane protocol relationships to fail, resulting in a DoS condition. For more information, see the section of this advisory. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation activities are performed precisely to discover when delivered functionality fails to match published specifications.
Requiring a documented development process and supporting tools reduces the chance that specified functionality will be implemented incorrectly.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 requires that security be designed and implemented in the SDLC (including secure coding, requirements, testing and checkpoints), but does not itself stop incorrect functionality from being exploitable once the code is written and deployed; the weakness can still be present and reachable.
Explicit application security requirements and acceptance criteria help ensure the delivered software matches its intended specifications.
Security testing in development and acceptance validates that implemented functionality conforms to specifications before release.
Change management processes reduce the chance of unintended functional deviations during updates, though they do not directly address initial specification conformance.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-684, a class-level weakness, and none of its children carries one either.