Summary

• Cisco released its semiannual Cisco IOS XR Software Security Advisory Bundled Publication on September 11, 2024. In direct response to customer feedback, Cisco releases bundles of Cisco IOS XR Software Security Advisories on the second Wednesday of the month in March and September of each calendar year.

  The September 11, 2024, release of the Cisco IOS XR Software Security Advisory Bundled Publication includes seven Cisco Security Advisories that describe eight vulnerabilities in Cisco IOS XR Software. Cisco has released software updates that address these vulnerabilities.

   

Details

• The following table identifies Cisco Security content that is associated with this bundled publication:

  Cisco Security Advisory	CVE ID	Security Impact Rating	CVSS Base Score
  Cisco IOS XR Software CLI Privilege Escalation Vulnerability	CVE-2024-20398	High	8.8
  Cisco IOS XR Software UDP Packet Memory Exhaustion Vulnerability	CVE-2024-20304	High	8.6
  Cisco Routed Passive Optical Network Controller Vulnerabilities	CVE-2024-20483 CVE-2024-20489	High	8.4
  Cisco IOS XR Software Network Convergence System Denial of Service Vulnerability	CVE-2024-20317	High	7.4
  Cisco IOS XR Software Segment Routing for Intermediate System-to-Intermediate System Denial of Service Vulnerability	CVE-2024-20406	High	7.4
  Cisco IOS XR Software CLI Arbitrary File Read Vulnerability	CVE-2024-20343	Medium	5.5
  Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service Vulnerability	CVE-2024-20390	Medium	5.3

   

  Related Resources

  Cisco Security Vulnerability Policy
  MITRE Common Vulnerabilities and Exposures
  Common Vulnerability Scoring System and the Security Impact Rating
  Common Vulnerability Scoring System Q & A