Cisco IOS XE Software - CraftedSignal Threat Feed

Cisco IOS XE DHCP Snooping BOOTP VLAN Leakage DoS (CVE-2026-20084)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

CVE-2026-20084 is a vulnerability affecting the DHCP snooping feature within Cisco IOS XE Software, specifically impacting Cisco Catalyst 9000 Series Switches. This vulnerability allows an unauthenticated, remote attacker to exploit improper handling of BOOTP packets. By sending either unicast or broadcast BOOTP request packets, an attacker can trigger the forwarding of BOOTP packets between different VLANs. This cross-VLAN forwarding, or "BOOTP VLAN leakage," can result in elevated CPU utilization, rendering the device unreachable through console or remote management interfaces. The ultimate impact is a denial-of-service (DoS) condition, preventing the affected switch from forwarding network traffic and disrupting network services. The vulnerability stems from how the Cisco IOS XE software processes BOOTP packets when DHCP snooping is enabled.

Attack Chain

The attacker identifies a vulnerable Cisco Catalyst 9000 Series Switch running Cisco IOS XE with DHCP snooping enabled.
The attacker crafts a malicious BOOTP request packet. This packet can be either a unicast or broadcast BOOTP request.
The attacker sends the malicious BOOTP request packet to the targeted switch.
The vulnerable DHCP snooping feature improperly processes the BOOTP request.
Due to the improper handling, the switch forwards the BOOTP packet to an unintended VLAN.
This BOOTP VLAN leakage contributes to increased CPU utilization on the switch.
The high CPU utilization degrades the switch's performance, impacting its ability to forward network traffic.
The switch becomes unresponsive, leading to a denial-of-service condition, disrupting network services for connected devices.

Impact

Successful exploitation of CVE-2026-20084 leads to a denial-of-service condition on affected Cisco Catalyst 9000 Series Switches. This DoS can disrupt network services, causing connectivity issues for users and applications relying on the compromised switch. The high CPU utilization makes the device unreachable for management, complicating recovery efforts. While the exact number of potential victims is unknown, any organization using vulnerable Cisco Catalyst 9000 Series Switches is at risk. The network downtime caused by this vulnerability can lead to financial losses and reputational damage.

Recommendation

Monitor network traffic for unusual BOOTP packet activity, specifically looking for packets being forwarded between VLANs, using a network intrusion detection system (IDS) and the network_connection log source.
Deploy the Sigma rule provided to detect BOOTP packets being forwarded between VLANs, and tune the rule for your specific environment.
Implement workarounds provided by Cisco to mitigate the vulnerability until a patch can be applied (reference the Cisco advisory for specific workaround details).

Cisco IOS XE Software TLS Memory Exhaustion Vulnerability (CVE-2026-20004)

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

CVE-2026-20004 is a critical vulnerability affecting the TLS library within Cisco IOS XE Software. An unauthenticated attacker positioned adjacent to a vulnerable device can exploit this flaw to exhaust the device's available memory. This vulnerability arises from improper management of memory resources during the establishment of TLS connections. The attack can be initiated in multiple ways, including but not limited to, repeated attempts at Extensible Authentication Protocol (EAP) authentication when local EAP is active. Another attack vector involves a machine-in-the-middle (MitM) approach, where TLS connections are reset between the affected Cisco device and other network entities. Successful exploitation leads to complete memory exhaustion, forcing an unexpected device reload and a subsequent denial-of-service (DoS) condition. This can impact network availability and critical services relying on the affected Cisco device.

Attack Chain

Attacker establishes network adjacency to the target Cisco IOS XE device.
Attacker initiates a series of TLS connection requests to the target device.
If local EAP is enabled, the attacker repeatedly attempts EAP authentication, triggering memory allocation on each attempt.
Alternatively, the attacker performs a Machine-in-the-Middle (MitM) attack to intercept and reset existing TLS connections between the target device and other devices.
The target device improperly manages memory resources during each TLS connection setup (either through EAP or MitM reset), leading to increasing memory consumption.
The attacker continues to send TLS connection requests or reset existing connections, further exhausting the device's memory.
The available memory on the affected device is completely depleted due to the continuous allocation.
The device experiences an unexpected reload, resulting in a denial-of-service condition, disrupting network services.

Impact

Successful exploitation of CVE-2026-20004 can lead to a complete denial of service on the affected Cisco IOS XE device. This can disrupt network operations, causing downtime and impacting critical services. The severity is amplified as it can be triggered by an unauthenticated, adjacent attacker. The number of potential victims depends on the number of Cisco IOS XE devices running vulnerable software versions with exposed TLS services. The impact extends to any organization relying on these devices for network connectivity and service delivery.

Recommendation

Upgrade Cisco IOS XE Software to a version that addresses CVE-2026-20004 as soon as possible, as documented in the Cisco security advisory.
Monitor network traffic for suspicious TLS connection patterns, particularly repeated connection attempts from the same adjacent source (using network_connection logs and creating custom rules).
Implement network segmentation to limit the exposure of Cisco IOS XE devices to adjacent networks where potential attackers may reside.
Consider disabling local EAP if it is not required, to mitigate the risk of exploitation via repeated EAP authentication attempts.

Cisco IKEv2 Memory Leak Vulnerability (CVE-2026-20012)

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

CVE-2026-20012 affects the Internet Key Exchange version 2 (IKEv2) implementation in Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software. Published in March 2026, the vulnerability stems from the improper parsing of IKEv2 packets. An unauthenticated, remote attacker can exploit this flaw by sending crafted IKEv2 packets to a vulnerable device. Successful exploitation leads to a memory leak, resulting in a denial-of-service (DoS) condition. For IOS and IOS XE Software, this manifests as a device reload, while ASA and FTD Software experience partial exhaustion of system memory, leading to instability and the inability to establish new IKEv2 VPN sessions. Recovery requires a manual reboot. This vulnerability poses a significant threat to network availability and security.

Attack Chain

The attacker identifies a vulnerable Cisco device running IKEv2.
The attacker crafts malicious IKEv2 packets designed to exploit the parsing vulnerability.
The attacker sends the crafted IKEv2 packets to the target device over UDP port 500 or 4500, the standard ports for IKEv2.
The vulnerable device improperly parses the malicious IKEv2 packets.
The improper parsing triggers a memory leak within the IKEv2 process.
The memory leak gradually consumes available system memory.
On Cisco IOS and IOS XE Software, the device reaches a critical memory threshold, causing a system reload and a DoS condition.
On Cisco ASA and FTD Software, the memory exhaustion leads to system instability, preventing the establishment of new IKEv2 VPN sessions and requiring a manual reboot to recover.

Impact

A successful exploit of CVE-2026-20012 can lead to significant disruption of network services. Cisco IOS and IOS XE devices may experience complete outages due to device reloads, affecting all services reliant on those devices. Cisco ASA and FTD devices will suffer degraded performance and an inability to establish new VPN connections, impacting remote access and secure communication. The necessity of a manual reboot for recovery prolongs the downtime and requires administrative intervention. The vulnerability has a CVSS v3.1 base score of 8.6, highlighting its severity.

Recommendation

Upgrade Cisco IOS Software and IOS XE Software to patched versions to prevent device reloads (Refer to Cisco advisory for specific versions and patch information).
Upgrade Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software to patched versions to prevent system instability and memory exhaustion (Refer to Cisco advisory for specific versions and patch information).
Monitor network traffic for suspicious IKEv2 packets originating from untrusted sources, focusing on unusual packet structures or sizes (Enable network connection logging and deploy the "Detect Suspicious IKEv2 Traffic" Sigma rule).
Implement rate limiting for IKEv2 traffic to mitigate the impact of potential exploits (Consult your Cisco device documentation for rate limiting configuration).