CVE-2024-20263: Cisco CBS250 Auth Bypass Vulnerability

CVE-2024-20263 Overview

CVE-2024-20263 is an access control flaw affecting Cisco Business 250 Series Smart Switches and Business 350 Series Managed Switches operating in a stacked configuration. The vulnerability allows an unauthenticated, remote attacker to bypass access control list (ACL) protections by sending crafted traffic through an affected device. The issue stems from incorrect ACL processing on backup switches after the primary or backup switch experiences a full stack reload or power cycle. In the vulnerable state, ACLs remain correctly applied on the primary device but may be incorrectly applied to backup devices, causing traffic to be dropped or forwarded unexpectedly. The vulnerability is tracked under [CWE-284: Improper Access Control].

Critical Impact
An unauthenticated, remote attacker can bypass configured ACL protections on stacked Cisco Business switches, allowing traffic that should be filtered to traverse the network.

Affected Products

Cisco Business 250 Series Smart Switches (CBS250 family, all firmware variants)
Cisco Business 350 Series Managed Switches (CBS350 family, all firmware variants)
Cisco Small Business 350X, 550X, and SF550X Series Switches (SG350X, SG350XG, SG550X, SG550XG, SF550X) in stacked configuration

Discovery Timeline

2024-01-26 - CVE-2024-20263 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-20263

Vulnerability Analysis

The vulnerability resides in the ACL synchronization logic between primary and backup units within a Cisco Business switch stack. When operators configure ACLs on a stacked deployment, the configuration is expected to propagate consistently across all stack members. Following a full stack reload or power cycle of the primary or backup unit, the ACL state on backup devices is not reconciled correctly. Traffic forwarded through the affected backup switch is evaluated against an incomplete or stale ACL state, permitting packets that should be denied or denying packets that should be permitted. Because the attack requires only network access to the affected device and sending crafted traffic, no authentication or user interaction is needed.

Root Cause

The defect is improper access control [CWE-284] in the stack synchronization process. ACL rules are not deterministically applied to backup stack members after the unit transitions back into operational state following a reload or power cycle. The condition is not attacker-controlled, meaning exploitation depends on the device entering the vulnerable state through normal operational events such as power loss or planned reloads.

Attack Vector

An attacker must send network traffic through an affected stacked switch while it is in the vulnerable state. The attacker cannot trigger the precondition directly. Once the condition exists, crafted packets that should be blocked by a configured ACL traverse the backup device, enabling lateral movement, unauthorized access to segmented network zones, or disruption of legitimate flows. The vulnerability has a changed scope, meaning the impact extends beyond the affected switch to the broader network it protects.

No public exploit code or proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-20263

Indicators of Compromise

Traffic flows observed in switch counters that match patterns explicitly denied by configured ACLs.
Discrepancies between ACL hit counters on primary versus backup stack members following a reload or power cycle event.
Unexpected traffic dropped or forwarded by backup units after stack state transitions.

Detection Strategies

Compare ACL configuration and hit-count statistics across all stack members after any reload or power cycle to identify drift between primary and backup state.
Deploy out-of-band network telemetry (NetFlow, IPFIX, or SPAN) to detect traffic that should be denied by ACLs reaching protected segments.
Correlate switch syslog events indicating stack reloads or master/backup transitions with subsequent ACL anomalies.

Monitoring Recommendations

Alert on any STACK or RELOAD related syslog messages and trigger automated ACL state validation across stack members.
Establish baselines of expected denied-traffic counters and alert on sudden drops that may indicate ACLs are no longer enforcing as configured.
Monitor inter-VLAN and inter-segment traffic for policy violations using upstream firewalls or network detection and response sensors that operate independent of the switch ACLs.

How to Mitigate CVE-2024-20263

Immediate Actions Required

Apply the firmware updates referenced in the Cisco Security Advisory for all affected CBS250, CBS350, SG350X, SG350XG, SG550X, SG550XG, and SF550X models.
Inventory all stacked Cisco Business switches and confirm firmware versions against the fixed releases identified by Cisco.
After any stack reload or power cycle, validate ACL enforcement on backup units before returning devices to production traffic.

Patch Information

Cisco has released fixed firmware addressing CVE-2024-20263. Refer to the Cisco Security Advisory cisco-sa-sb-bus-acl-bypass-5zn9hNJk for the complete list of fixed firmware versions and upgrade guidance. There are no workarounds that address this vulnerability; upgrading firmware is the only supported remediation.

Workarounds

No workarounds are available according to the Cisco Security Advisory; firmware upgrade is required.
As a compensating control, enforce critical network segmentation policies on upstream firewalls or Layer 3 devices that are not part of the affected switch stack.
Where operationally feasible, reduce reliance on stacked configurations for security-critical ACL enforcement until patches are applied.

bash

# Example: validate ACL state across stack members after a reload
# Connect to the stack master and inspect ACL bindings and hit counts
show access-lists
show interfaces access-lists
show stack
# Reapply ACL configuration explicitly if drift is detected between units
copy running-config startup-config