CVE-2024-20271: ios xe Input Validation Flaw — Fix

Description

A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of certain IPv4 packets. An attacker could exploit this vulnerability by sending a crafted IPv4 packet either to or through an affected device. A successful exploit could allow the attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To successfully exploit this vulnerability, the attacker does not need to be associated with the affected AP. This vulnerability cannot be exploited by sending IPv6 packets.

Is your site exposed to CVE-2024-20271?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness Type (CWE)

CWE-20 Improper Input Validation

Affected Products

Vendor	Product	Versions
cisco	ios_xe	< 17.3.8
cisco	ios_xe	17.4 — 17.6.6
cisco	ios_xe	17.7 — 17.9.5
cisco	ios_xe	17.10 — 17.12.2
cisco	business_access_points	< 10.9.1.0
cisco	business_140ac	All
cisco	business_140ac_access_point	All
cisco	business_141acm	All
cisco	business_142acm	All
cisco	business_143acm	All
cisco	business_145ac	All
cisco	business_145ac_access_point	All
cisco	business_240ac	All
cisco	business_access_points	< 10.6.2.0
cisco	business_150ax	All
cisco	business_150ax_access_point	All
cisco	business_151axm	All
cisco	wireless_lan_controller_software	< 8.10.190.0

References

Advisories & Patches

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-dos-h9TGGX6W https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-dos-h9TGGX6W

Frequently Asked Questions

What is CVE-2024-20271? +

A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of certain IPv4 packets. An attacker could exploit this vulnerability by sending a crafted IPv4 packet either to or through an affected device. A successful exploit could allow the attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To successfully exploit this vulnerability, the attacker does not need to be associated with the affected AP. This vulnerability cannot be exploited by sending IPv6 packets. It has a CVSS v3.1 base score of 8.6 (HIGH).

How severe is CVE-2024-20271? +

CVE-2024-20271 has a CVSS v3.1 score of 8.6 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-20271? +

CVE-2024-20271 affects products from cisco, specifically: business_140ac, business_140ac_access_point, business_141acm, business_142acm, business_143acm, business_145ac, business_145ac_access_point, business_150ax, business_150ax_access_point, business_151axm, business_240ac, business_access_points, ios_xe, wireless_lan_controller_software. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-20271? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-13826

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is …

CVE-2024-54011

Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in …

CVE-2026-62656

A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted …

CVE-2026-62658

A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to …

CVE-2026-56349

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail …

CVE-2026-6409

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured …

CVE-2024-20271