CVE-2024-20307: Cisco IOS IKEv1 DoS Vulnerability

CVE-2024-20307 Overview

A vulnerability in the IKEv1 fragmentation code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a heap overflow, resulting in an affected device reloading. This vulnerability exists because crafted, fragmented IKEv1 packets are not properly reassembled. An attacker could exploit this vulnerability by sending crafted UDP packets to an affected system. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition.

This vulnerability can be triggered by both IPv4 and IPv6 traffic directed to the affected system. Only traffic that is directed to the affected system can be used to exploit this vulnerability.

Critical Impact

Successful exploitation allows unauthenticated remote attackers to cause affected Cisco IOS and IOS XE devices to reload, resulting in service disruption and potential network outages for organizations relying on these devices for VPN connectivity.

Affected Products

• Cisco IOS Software (multiple versions from 15.1 through 15.9)
• Cisco IOS XE Software (versions from 3.4.8sg through 17.11.x)
• Network devices with IKEv1 VPN configurations enabled

Discovery Timeline

• 2024-03-27 - CVE-2024-20307 published to NVD
• 2025-07-30 - Last updated in NVD database

Technical Details for CVE-2024-20307

Vulnerability Analysis

This heap overflow vulnerability (CWE-121: Stack-based Buffer Overflow) resides in the IKEv1 fragmentation handling code within Cisco IOS and IOS XE software. The vulnerability stems from improper reassembly of fragmented IKEv1 packets. When the affected software processes specially crafted fragmented UDP packets, it fails to properly validate the fragment boundaries and sizes during the reassembly process, leading to a heap-based buffer overflow condition.

The attack can be executed remotely over the network without requiring any authentication or user interaction. Since IKEv1 is commonly used for establishing VPN tunnels, affected devices are often exposed to untrusted networks, increasing the attack surface. The vulnerability impacts only the availability of the device—there is no unauthorized access to confidential data or ability to modify system configurations.

Root Cause

The root cause of this vulnerability is improper validation of IKEv1 fragment data during packet reassembly. When fragmented IKEv1 packets arrive at an affected device, the reassembly logic does not adequately verify that the combined fragment sizes will fit within the allocated heap buffer. An attacker can craft fragments with manipulated size and offset values that, when reassembled, cause a write operation beyond the allocated buffer boundaries. This heap corruption ultimately leads to a device crash and reload.

Attack Vector

The attack is network-based and requires the attacker to send crafted UDP packets containing malformed IKEv1 fragments to an affected Cisco device. The attack requires:

1. Network Access: The attacker must be able to send UDP packets to the target device on the IKEv1 service port (typically UDP port 500 for ISAKMP)
2. IKEv1 Enabled: The target device must have IKEv1 configured and processing traffic
3. Crafted Fragments: The attacker sends specially crafted fragmented IKEv1 packets designed to trigger the improper reassembly behavior
4. IPv4 or IPv6: The attack can be executed over either protocol stack

The vulnerability can be triggered by sending a series of fragmented IKEv1 packets with carefully manipulated fragment offset and length values. When the device attempts to reassemble these fragments, the heap overflow occurs, corrupting memory structures and causing the device to crash and reload.

Detection Methods for CVE-2024-20307

Indicators of Compromise

• Unexpected device reloads or crashes with crashinfo files referencing IKEv1 or ISAKMP processing
• Unusual volumes of fragmented IKEv1 traffic from specific source IP addresses
• Crash dump analysis showing heap corruption in IKEv1-related memory regions
• Syslog messages indicating IKEv1 processing errors immediately before device reload

Detection Strategies

• Monitor for repeated device reloads and analyze crash dump files for IKEv1-related heap corruption signatures
• Implement network monitoring to detect anomalous volumes of fragmented UDP traffic on port 500 (ISAKMP)
• Configure SNMP traps and syslog alerts for unexpected device reload events
• Deploy intrusion detection/prevention systems with signatures for malformed IKEv1 fragment patterns

Monitoring Recommendations

• Enable logging for IKEv1 negotiation events and review logs for anomalies before any crash events
• Implement traffic baseline monitoring to identify unusual patterns in VPN negotiation traffic
• Use network flow analysis to detect sources sending excessive fragmented ISAKMP packets
• Configure automated alerting for device availability changes across Cisco infrastructure

How to Mitigate CVE-2024-20307

Immediate Actions Required

• Review the Cisco Security Advisory and determine if your devices are running vulnerable software versions
• Apply available software updates from Cisco to remediate the vulnerability
• Implement access control lists (ACLs) to restrict IKEv1 traffic to known, trusted peer IP addresses only
• Consider migrating from IKEv1 to IKEv2 where possible, as IKEv2 is not affected by this vulnerability

Patch Information

Cisco has released software updates that address this vulnerability. Organizations should consult the Cisco Security Advisory (cisco-sa-ikev1-NO2ccFWz) to identify the appropriate fixed software versions for their specific IOS or IOS XE release train. The advisory provides detailed guidance on fixed releases across the extensive range of affected software versions.

Given the large number of affected versions spanning Cisco IOS 15.1(2)SG8 through 15.9(3)M7a and IOS XE 3.4.8sg through 17.11.99sw, administrators should use Cisco's Software Checker tool referenced in the advisory to verify vulnerability status and identify appropriate upgrade targets.

Workarounds

• Restrict IKEv1 traffic using infrastructure ACLs to permit connections only from known VPN peer addresses
• Consider migrating VPN configurations from IKEv1 to IKEv2, which provides improved security and is not affected by this vulnerability
• Implement Control Plane Policing (CoPP) to rate-limit IKEv1 traffic and reduce the impact of potential exploitation attempts

# Example ACL to restrict IKEv1 traffic to known peers
access-list 101 permit udp host 192.0.2.10 any eq 500
access-list 101 permit udp host 198.51.100.20 any eq 500
access-list 101 deny udp any any eq 500
access-list 101 permit ip any any

# Apply to interface facing untrusted networks
interface GigabitEthernet0/0
 ip access-group 101 in