CVE-2024-20303: Cisco IOS XE mDNS Gateway DoS Vulnerability

CVE-2024-20303 Overview

CVE-2024-20303 is a denial-of-service vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs). An unauthenticated adjacent attacker connected to the wireless network can send a continuous stream of crafted mDNS packets to exhaust controller resources. Successful exploitation drives the wireless controller into high CPU utilization, causing access points (APs) to lose their connection to the controller. The flaw is tracked under CWE-459: Incomplete Cleanup and stems from improper management of mDNS client entries.

Critical Impact
Sustained high CPU on the WLC can disconnect all associated APs, producing a wireless outage across the affected site.

Affected Products

Cisco IOS XE Software releases 17.2.1 through 17.11.1a on Wireless LAN Controllers
Cisco Catalyst 9800 Series Wireless Controllers (9800-40, 9800-80, 9800-L, CW9800H1, CW9800H2, CW9800M)
Cisco Catalyst 9800-CL Wireless Controllers for Cloud and Catalyst 9100-series access points (9105AXI, 9115AXE/AXI, 9117AXI, 9120AXE/AXI/AXP, 9130AXE/AXI)

Discovery Timeline

2024-03-27 - CVE-2024-20303 published to NVD by Cisco
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20303

Vulnerability Analysis

The mDNS gateway feature on Cisco Catalyst 9800 WLCs proxies mDNS service discovery traffic between wireless clients and wired network segments. When enabled, the controller tracks mDNS clients in an internal state table. The vulnerability lies in how those client entries are managed and cleaned up. An attacker associated to the wireless network can flood the controller with specific mDNS packets that continuously allocate or hold client entries, driving CPU utilization on the control plane to unsustainable levels. Once CPU pressure is high enough, Control and Provisioning of Wireless Access Points (CAPWAP) keepalives to the APs are impacted and APs disconnect from the controller, producing a wireless denial-of-service condition.

Root Cause

The underlying weakness is classified as CWE-459 (Incomplete Cleanup). The mDNS gateway process does not properly age out or release client entries triggered by attacker-crafted traffic. Continuous packet ingress causes uncontrolled processing overhead in the mDNS client-tracking logic.

Attack Vector

The attack vector is adjacent network (AV:A) and requires no authentication or user interaction. The attacker must associate to a wireless network served by a vulnerable controller, then transmit a sustained stream of crafted mDNS packets toward the controller. No exploit code is publicly available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Cisco Security Advisory cisco-sa-wlc-mdns-dos-4hv6pBGf for authoritative technical details.

Detection Methods for CVE-2024-20303

Indicators of Compromise

Sustained high control-plane CPU utilization on Catalyst 9800 WLCs, particularly in mDNS-related processes
Bulk CAPWAP disconnections and AP re-join events without a corresponding network or power event
Abnormally high volume of mDNS (UDP/5353) traffic sourced from a single wireless client MAC
Rapid growth in the mDNS client cache on the controller

Detection Strategies

Baseline WLC CPU per process and alert on deviations in mDNS and control-plane utilization
Monitor mDNS client-table size via show mdns-sd statistics and show mdns-sd summary for unexpected growth
Correlate spikes in mDNS packet rate with AP disassociation events in wireless syslog
Ingest WLC syslog and SNMP telemetry into a SIEM to detect DoS-like patterns across multiple controllers

Monitoring Recommendations

Forward Catalyst 9800 syslog and NetFlow to a centralized analytics platform for continuous review
Alert on repeated CAPWAP-3-DISCONNECT and DOT11-5-DISASSOC events aggregated by AP group
Track per-client mDNS packet rates and cap alerting thresholds based on normal service-discovery volume
Include WLC CPU and mDNS metrics in wireless service-health dashboards

How to Mitigate CVE-2024-20303

Immediate Actions Required

Identify controllers running Cisco IOS XE 17.2.1 through 17.11.1a and check whether the mDNS gateway feature is enabled
Apply the fixed Cisco IOS XE release identified in the Cisco Security Advisory
Restrict wireless network access with strong authentication (WPA2/WPA3-Enterprise, 802.1X) to reduce the pool of potential adjacent attackers
Enable logging and CPU monitoring on all Catalyst 9800 controllers pending patch deployment

Patch Information

Cisco has released fixed software addressing CVE-2024-20303. Consult the Cisco Security Advisory cisco-sa-wlc-mdns-dos-4hv6pBGf for the specific fixed IOS XE versions applicable to each Catalyst 9800 platform. There are no software-only workarounds published by Cisco; upgrading to a fixed release is the recommended remediation.

Workarounds

Disable the mDNS gateway feature on WLCs where it is not required for service discovery
Apply wireless client isolation and rate-limit mDNS (UDP/5353) traffic where operationally feasible
Segment guest and untrusted SSIDs from controllers hosting production mDNS gateway configurations
Enforce client authentication on all wireless networks served by affected controllers

bash

# Verify mDNS gateway status and disable if not required (Catalyst 9800)
show mdns-sd summary
show mdns-sd statistics

configure terminal
 no mdns-sd gateway
end
write memory