CVE-2024-20276: Cisco IOS Catalyst 6000 DoS Vulnerability

CVE-2024-20276 Overview

CVE-2024-20276 is a denial of service (DoS) vulnerability in Cisco IOS Software running on Cisco Catalyst 6000 Series Switches. The flaw stems from improper handling of process-switched traffic on the affected platforms. An unauthenticated, adjacent attacker can send crafted traffic to force the device into an unexpected reload. Successful exploitation results in a service outage until the switch completes its recovery cycle. Cisco published the advisory on March 27, 2024, and the issue is tracked under CWE-248: Uncaught Exception.

Critical Impact
A single crafted packet from an adjacent network position can reload core Catalyst 6000 switches, disrupting downstream traffic for every host and service that depends on the affected chassis.

Affected Products

Cisco IOS Software releases 15.5(1)SY5 through 15.5(1)SY11
Cisco Catalyst 6503-E, 6504-E, 6506-E, 6509-E, 6509-V-E, 6513-E, and 6807-XL chassis
Cisco Catalyst C6800-SUP6T and C6800-SUP6T-XL supervisor engines

Discovery Timeline

2024-03-27 - CVE-2024-20276 published to the National Vulnerability Database
2024-03-27 - Cisco publishes security advisory cisco-sa-ios-dos-Hq4d3tZG
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20276

Vulnerability Analysis

The vulnerability resides in the process-switching path of Cisco IOS Software on Catalyst 6000 Series Switches. Process-switched traffic is punted to the route processor for CPU-based handling rather than being forwarded in hardware. When the affected code path receives specific crafted traffic, it fails to handle an exception condition safely and causes the device to reload.

The issue is classified under CWE-248 (Uncaught Exception). The reload interrupts all switched and routed traffic passing through the chassis. Because the attacker does not need credentials or user interaction, any host on an adjacent Layer 2 or Layer 3 segment can trigger the condition. The vulnerability affects availability only; confidentiality and integrity are not impacted.

Root Cause

The root cause is improper handling of process-switched traffic in the IOS forwarding subsystem. Crafted packets reach a code path that lacks adequate exception handling, and the resulting fault forces the switch into a full reload rather than dropping the offending frame. The scope is marked as changed because a failure on the supervisor engine impacts every module and downstream network segment in the chassis.

Attack Vector

Exploitation requires adjacent network access to the target switch. An attacker sends crafted traffic destined for the device or traffic that the device must process in software (for example, control-plane, management-plane, or exception-punted traffic). No authentication or user interaction is required. Cisco has not reported public exploit code or exploitation in the wild for this issue.

See the Cisco Security Advisory cisco-sa-ios-dos-Hq4d3tZG for the authoritative technical description.

Detection Methods for CVE-2024-20276

Indicators of Compromise

Unplanned device reloads on Catalyst 6503-E, 6504-E, 6506-E, 6509-E, 6509-V-E, 6513-E, or 6807-XL chassis running affected IOS versions.
Crash files or show version output indicating recent restart reasons tied to exception handling in the process-switching subsystem.
Repeated syslog %SYS-5-RESTART or supervisor switchover events without a corresponding operational change.

Detection Strategies

Correlate SNMP coldStart and warmStart traps from Catalyst 6000 devices with upstream flow records to identify the traffic pattern that preceded the reload.
Alert on bursts of process-switched traffic reaching the route processor using NetFlow, control-plane policing counters, or show processes cpu history.
Compare running IOS versions against the fixed releases in cisco-sa-ios-dos-Hq4d3tZG and flag devices still running 15.5(1)SY5 through 15.5(1)SY11.

Monitoring Recommendations

Forward switch syslog and SNMP trap data into a centralized SIEM or data lake for reload correlation across the fleet.
Baseline CPU utilization on Catalyst 6000 supervisors and alert on sustained spikes in the IP Input or similar process-switching threads.
Enable Control Plane Policing (CoPP) telemetry and monitor drops to identify anomalous traffic aimed at the route processor.

How to Mitigate CVE-2024-20276

Immediate Actions Required

Inventory all Catalyst 6000 Series chassis and identify devices running Cisco IOS 15.5(1)SY5 through 15.5(1)SY11.
Schedule maintenance windows to upgrade affected supervisors to a fixed release identified in Cisco advisory cisco-sa-ios-dos-Hq4d3tZG.
Restrict adjacent network access to management and control-plane interfaces on affected switches until patching completes.

Patch Information

Cisco has released fixed Cisco IOS Software versions that address the improper process-switched traffic handling. Refer to the fixed software table in the Cisco Security Advisory for the minimum release that resolves CVE-2024-20276 on each supervisor and chassis combination.

Workarounds

Cisco lists no dedicated workarounds; upgrading IOS is the supported remediation path.
Apply Control Plane Policing (CoPP) and infrastructure ACLs to rate-limit and filter untrusted traffic destined to the switch route processor as a defense-in-depth measure.
Segment Layer 2 and Layer 3 access so that untrusted endpoints cannot reach the management or control plane of Catalyst 6000 supervisors.

bash

# Example CoPP policy to rate-limit unclassified traffic to the route processor
class-map match-any COPP-UNCLASSIFIED
 match any
!
policy-map COPP-POLICY
 class COPP-UNCLASSIFIED
  police 32000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY