CVE-2024-20436

Summary

CVE-2024-20436 is a newly disclosed vulnerability affecting the HTTP Server feature in Cisco IOS XE Software, particularly when the Telephony Service feature is enabled. This issue permits an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on impacted devices. The root cause of this vulnerability is a null pointer dereference that occurs when accessing certain URLs. An attacker can capitalize on this flaw by sending tailored HTTP traffic to the vulnerable device, potentially leading to a device reload and subsequent DoS condition.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.