CVE-2024-20266: Cisco IOS XR DHCPv4 DoS Vulnerability

CVE-2024-20266 Overview

CVE-2024-20266 is a denial of service vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software. An unauthenticated, remote attacker can send a malformed DHCPv4 message to trigger a crash of the dhcpd process on an affected device. The router itself does not reload, but DHCPv4 server services remain unavailable for approximately two minutes while the process restarts. Clients that attempt to join the network during that window and depend on the affected device for address assignment lose network access. The flaw is tracked under CWE-476 (NULL Pointer Dereference) and only affects DHCPv4. DHCPv6 deployments are not affected.

Critical Impact
A single malformed DHCPv4 packet can crash the dhcpd process on Cisco IOS XR devices, disrupting DHCP services for approximately two minutes per exploitation attempt.

Affected Products

Cisco IOS XR Software with the DHCPv4 server feature enabled
Cisco routing platforms running vulnerable IOS XR releases
Deployments relying on the IOS XR dhcpd process for client address assignment

Discovery Timeline

2024-03-13 - CVE-2024-20266 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20266

Vulnerability Analysis

The vulnerability resides in the DHCPv4 server component of Cisco IOS XR Software. The dhcpd process performs insufficient validation on incoming DHCPv4 messages before processing certain fields. When a malformed message reaches the parser, the process dereferences invalid memory and crashes. IOS XR automatically restarts dhcpd, but recovery takes roughly two minutes. During that recovery window, any client that requests an IP address from the affected server fails to obtain a lease and cannot access the network. An attacker can repeatedly send crafted DHCPv4 packets to maintain a sustained denial of service against DHCP clients on the impacted broadcast domain.

Root Cause

The defect is classified as a NULL pointer dereference [CWE-476]. Specific DHCPv4 message fields are not validated before the dhcpd process operates on associated pointers. When the pointer resolves to a NULL value derived from a malformed field, the process terminates abnormally.

Attack Vector

Exploitation requires network reachability to UDP port 67 on the affected device but does not require authentication or user interaction. An attacker constructs a malformed DHCPv4 message, such as a DISCOVER or REQUEST packet with malformed options, and sends it to the DHCPv4 server interface. The dhcpd process crashes during message parsing.

No verified public proof-of-concept exploit code is available. Refer to the Cisco Security Advisory for authoritative technical details.

Detection Methods for CVE-2024-20266

Indicators of Compromise

Unexpected termination and restart of the dhcpd process on IOS XR devices, visible in system logs and show processes output.
Gaps in DHCPv4 lease assignments correlated with malformed inbound DHCP traffic on UDP port 67.
Repeated DHCPv4 messages from a single source containing malformed options or truncated fields.

Detection Strategies

Monitor IOS XR syslog for dhcpd process crash messages and automatic restart events.
Inspect DHCPv4 traffic at network ingress points for malformed or non-RFC-compliant packet structures.
Baseline normal DHCP client-to-server ratios and alert on anomalous spikes in DISCOVER or REQUEST traffic from single sources.

Monitoring Recommendations

Forward IOS XR process and system logs to a centralized SIEM for correlation with network telemetry.
Enable NetFlow or IPFIX on router interfaces facing untrusted segments to identify sources of malformed DHCP traffic.
Track DHCP lease acquisition failure rates on downstream clients as an early signal of dhcpd unavailability.

How to Mitigate CVE-2024-20266

Immediate Actions Required

Apply the fixed IOS XR release identified in the Cisco Security Advisory for the affected platform.
Inventory all IOS XR devices with the DHCPv4 server feature enabled and prioritize patching those exposed to untrusted networks.
Restrict DHCPv4 server exposure to trusted VLANs and management segments where feasible.

Patch Information

Cisco has released fixed software addressing CVE-2024-20266. Consult the Cisco Security Advisory cisco-sa-iosxr-dhcp-dos-3tgPKRdm for the fixed release matrix corresponding to each affected IOS XR train.

Workarounds

Disable the DHCPv4 server feature on devices where it is not required for operations.
Apply infrastructure access control lists (iACLs) to restrict DHCPv4 traffic on UDP port 67 to trusted client subnets only.
Use DHCP relay agents or dedicated DHCP servers in place of the IOS XR dhcpd process where the deployment permits.

bash

# Example: restrict inbound DHCPv4 to a trusted client subnet
# Refer to Cisco documentation for platform-specific iACL syntax
ipv4 access-list PROTECT-DHCPD
 permit udp 10.10.0.0 0.0.255.255 any eq bootps
 deny   udp any any eq bootps
 permit ipv4 any any
!
interface TenGigE0/0/0/0
 ipv4 access-group PROTECT-DHCPD ingress
!