CVE-2024-20313: Cisco IOS XE OSPFv2 DoS Vulnerability

CVE-2024-20313 Overview

CVE-2024-20313 is a denial of service vulnerability in the Open Shortest Path First version 2 (OSPFv2) feature of Cisco IOS XE Software. An unauthenticated, adjacent attacker can send a malformed OSPF update to trigger an unexpected device reload. The flaw stems from improper validation of OSPF updates processed by the device, classified under [CWE-120] buffer copy without checking size of input. Successful exploitation forces the affected router or switch to reload, disrupting network routing operations. The vulnerability affects multiple Cisco IOS XE releases from 17.5.1 through 17.11.x.

Critical Impact
An adjacent, unauthenticated attacker can force affected Cisco IOS XE devices to reload, causing routing outages and network-wide denial of service conditions.

Affected Products

Cisco IOS XE Software versions 17.5.1 through 17.5.1a
Cisco IOS XE Software 17.6.x, 17.7.x, and 17.8.x release trains
Cisco IOS XE Software 17.9.x, 17.10.x, and 17.11.x release trains

Discovery Timeline

2024-04-24 - CVE-2024-20313 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20313

Vulnerability Analysis

The vulnerability resides in the OSPFv2 protocol implementation within Cisco IOS XE Software. OSPFv2 is a link-state interior gateway routing protocol used to exchange routing information between routers within an autonomous system. The affected component fails to properly validate the contents of inbound OSPF update packets before processing them.

When a malformed OSPF update reaches the device, improper input handling in the packet processing path causes the device to enter an unrecoverable state. The result is an unexpected reload of the affected system. Because OSPF operates at the network layer and requires Layer 2 adjacency, exploitation is limited to attackers on the same broadcast segment or within an established OSPF neighbor relationship.

Root Cause

The root cause is improper validation of fields within OSPFv2 update messages, mapped to [CWE-120] buffer copy without checking size of input. The OSPF process trusts inbound update packets from adjacent peers without enforcing sufficient bounds checking on packet fields. When a malformed update is parsed, the condition leads to a crash of the routing process and a device reload.

Attack Vector

Exploitation requires network adjacency but no authentication and no user interaction. An attacker must be positioned within the OSPF broadcast domain or established as an OSPF neighbor of the target device. The attacker then transmits a specifically crafted, malformed OSPFv2 update packet toward the affected device. Processing of the malicious update triggers the reload condition. Repeated transmission can produce sustained denial of service against routing infrastructure.

No public proof-of-concept exploit is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. EPSS scoring indicates a low probability of exploitation in the wild at the time of publication.

Detection Methods for CVE-2024-20313

Indicators of Compromise

Unexpected reboots of Cisco IOS XE devices with crash dumps referencing the OSPF process
OSPF adjacency flaps immediately preceding a device reload event
Malformed OSPFv2 update packets observed on the local segment via packet capture

Detection Strategies

Enable and monitor Cisco IOS XE crashinfo files for OSPF-related tracebacks after unexplained reloads
Deploy network intrusion detection signatures that flag OSPFv2 update packets with anomalous or malformed field values
Correlate SNMP traps and syslog messages reporting OSPF-5-ADJCHG state changes with subsequent device reload events

Monitoring Recommendations

Forward Cisco IOS XE syslog and crash telemetry into a centralized SIEM for correlation across routing infrastructure
Baseline normal OSPF neighbor churn and alert on unusual adjacency resets followed by device unavailability
Monitor Layer 2 segments hosting OSPF neighbors for unauthorized devices or unexpected OSPF speakers

How to Mitigate CVE-2024-20313

Immediate Actions Required

Inventory Cisco IOS XE devices and identify those running affected versions between 17.5.1 and 17.11.x
Apply the fixed software release identified in the Cisco Security Advisory
Restrict OSPF adjacencies to trusted interfaces and known neighbor IP addresses
Enable OSPF cryptographic authentication (MD5 or SHA) on all OSPF-enabled interfaces

Patch Information

Cisco has released fixed software addressing this vulnerability. Consult the Cisco Security Advisory cisco-sa-iosxe-ospf-dos-dR9Sfrxp for the fixed release matrix that maps each affected 17.x train to the corresponding remediated build. Customers should upgrade to a fixed release rather than rely on workarounds.

Workarounds

Configure OSPFv2 authentication using the ip ospf authentication message-digest command on OSPF interfaces to reject unauthenticated updates
Deploy control plane policing (CoPP) to rate-limit OSPF traffic destined to the device control plane
Segment OSPF domains to limit the set of adjacent devices that can transmit updates to affected routers

bash

# Configuration example: enable OSPF MD5 authentication on an interface
interface GigabitEthernet0/1
 ip ospf message-digest-key 1 md5 <strong-key>
 ip ospf authentication message-digest
!
router ospf 1
 area 0 authentication message-digest