High severity · published Mar 13, 2024
CVE-2024-20327
A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an…
7.4
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of malformed PPPoE packets that are received on a router that is running Broadband Network Gateway (BNG) functionality with PPPoE termination on a Lightspeed-based or Lightspeed-Plus-based line card. An attacker could exploit this vulnerability by sending a crafted PPPoE packet to an affected line card interface that does not terminate PPPoE. A successful exploit could allow the attacker to crash the ppp_ma process, resulting in a DoS condition for PPPoE traffic across the router.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cisco IOS XR Software · Cisco
5.2.0; 5.2.2; 5.2.4; 5.3.0; 5.3.1; 5.3.2; +34 more · source: vendor
IX
Ios XR · Cisco
before 7.9.21; 7.10 before 7.10.1; 7.11 before 7.11.1 · source: NVD
Affected product
CI
Cisco IOS XR Software
Cisco
More from Cisco IOS XR Software
8.8
CVE-2020-3118
Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability
8.6
CVE-2020-3569
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
8.6
CVE-2020-3566
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
6.5
CVE-2022-20821
Cisco IOS XR Software Health Check Open Port Vulnerability
9.8
CVE-2026-20279
Cisco IOS XR Software Security Hardening Release: September 2026