Medium severity · published Mar 27, 2024
CVE-2024-20265
A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure Boot functionality and load a…
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure Boot functionality and load a software image that has been tampered with on an affected device.
This vulnerability exists because unnecessary commands are available during boot time at the physical console. An attacker could exploit this vulnerability by interrupting the boot process and executing specific commands to bypass the Cisco Secure Boot validation checks and load an image that has been tampered with. This image would have been previously downloaded onto the targeted device. A successful exploit could allow the attacker to load the image once. The Cisco Secure Boot functionality is not permanently compromised.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cisco Aironet Access Point Software · Cisco
8.2.100.0; 8.2.130.0; 8.2.111.0; 8.2.110.0; 8.2.121.0; 8.2.141.0; +34 more · source: vendor
CA
Cisco Aironet Access Point Software (IOS XE Controller) · Cisco
16.10.1e; 16.10.1; 17.1.1t; 17.1.1s; 17.1.1; 16.11.1a; +34 more · source: vendor
CB
Cisco Business Wireless Access Point Software · Cisco
10.0.1.0; 10.0.2.0; 10.1.1.0; 10.1.2.0; 10.2.1.0; 10.2.2.0; +10 more · source: vendor
CI
Cisco IOS XE Software · Cisco
All versions, or not specified · source: vendor
AA
Aironet Access Point Software · Cisco
8.2.100.0 through 8.10.185.0; 16.10.1 through 17.11.1 · source: CISA
BW
Business Wireless Access Point Software · Cisco
10.0.1.0 through 10.8.1.0 · source: CISA
Affected product
CA
Cisco Aironet Access Point Software
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20265
sec.cloudapps.cisco.com
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-secureboot-bypass-zT5vJkSD
More from Cisco Aironet Access Point Software
8.6
CVE-2024-20271
A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an…
7.4
CVE-2024-20354
A vulnerability in the handling of encrypted wireless frames of Cisco Aironet Access Point (AP) Software could allow an unauthenticated, adjacent attacker to cause a denial of…
