CVE-2024-20322: Cisco IOS XR Auth Bypass Vulnerability

CVE-2024-20322 Overview

Cisco disclosed CVE-2024-20322, an access control list (ACL) bypass vulnerability affecting Cisco IOS XR Software on multiple service provider routing platforms. The flaw resides in ingress ACL processing on Pseudowire interfaces. An unauthenticated remote attacker can send crafted traffic through an affected device to reach resources that an operator intended to protect with a configured ACL. The weakness is tracked as CWE-284: Improper Access Control and primarily impacts Cisco 8000 Series, NCS 540, NCS 550x, NCS 560, and NCS 57xx routers running IOS XR 7.10.2 and 7.11.

Critical Impact
Remote attackers can bypass ingress ACLs on Pseudowire interfaces and reach services behind the router that should be filtered, undermining perimeter segmentation.

Affected Products

Cisco IOS XR Software versions 7.10.2 and 7.11
Cisco 8000 Series routers (8011, 8101, 8102, 8111, 8122, 8201, 8202, 8212, 8404, 8501, 8608, 8700, 8711, 8712, 8804, 8808, 8812, 8818)
Cisco Network Convergence System (NCS) 540, 540X, 5501, 5502, 5504, 5508, 5516, 55A1, 55A2, 560, 57B1, 57C1, 57C3, and 57D2 Series platforms

Discovery Timeline

2024-03-13 - CVE-2024-20322 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20322

Vulnerability Analysis

The vulnerability affects how Cisco IOS XR evaluates ingress ACLs on Pseudowire (PW) interfaces. Pseudowires emulate Layer 2 circuits across an MPLS or IP backbone and often sit at service provider edges where ACLs enforce tenant isolation and perimeter policy. When this control fails, traffic that should have been dropped at the ingress point reaches downstream resources, defeating segmentation and exposing internal services to unauthenticated network attackers.

Successful exploitation does not grant code execution, but it does provide reachability into protected networks. Attackers can use the bypass to probe filtered management planes, lateral services, or peered customer segments that the ACL was designed to isolate.

Root Cause

Cisco attributes the flaw to improper assignment of lookup keys to internal interface contexts within the ACL processing path. The Pseudowire ingress logic resolves the wrong context when matching packets against the configured ACL, causing permit/deny decisions to be evaluated against stale or incorrect state. The result is traffic that silently passes a filter it should have matched.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker on the network sends traffic destined for resources behind the affected device across a Pseudowire interface where an ingress ACL is configured. Because the ACL lookup key is misassigned, packets that should be denied are instead forwarded, giving the attacker access to filtered destinations. The Cisco security advisory for IOS XR ACL Bypass documents the affected configurations and triggering conditions.

Detection Methods for CVE-2024-20322

Indicators of Compromise

Flow records showing traffic reaching internal destinations through a Pseudowire interface that an ingress ACL should have denied.
Mismatches between configured ipv4 access-group or ipv6 access-group policies on Pseudowire interfaces and observed hit counters.
Unexpected connections to management or infrastructure addresses sourced from customer-facing PW circuits.

Detection Strategies

Compare ACL hit counters with upstream NetFlow or IPFIX telemetry to identify traffic that bypasses a configured deny rule.
Audit running configuration for Pseudowire interfaces with ingress ACLs and validate enforcement with controlled test traffic in a maintenance window.
Correlate router syslog events with downstream firewall and workload telemetry to spot sessions that reached protected assets without matching expected transit paths.

Monitoring Recommendations

Ingest IOS XR syslog, SNMP, and streaming telemetry into a centralized analytics platform to baseline ACL behavior and alert on deviations.
Monitor east-west and north-south flows terminating behind affected routers for connections that violate segmentation policy.
Track the Cisco PSIRT advisory and vendor fixed-release notices for the IOS XR trains deployed in your environment.

How to Mitigate CVE-2024-20322

Immediate Actions Required

Inventory all Cisco 8000 Series, NCS 540/550x/560/57xx devices running IOS XR 7.10.2 or 7.11 that terminate Pseudowire circuits.
Upgrade to a fixed IOS XR release as identified in the Cisco security advisory for IOS XR ACL Bypass.
Validate ACL enforcement on Pseudowire interfaces after patching by generating controlled test traffic that should be denied.

Patch Information

Cisco has published fixed software releases for IOS XR trains affected by CVE-2024-20322. Refer to the Cisco PSIRT security advisory for IOS XR ACL Bypass for the exact first-fixed releases that apply to your deployed train, and schedule maintenance windows to install them on edge and aggregation routers running vulnerable code.

Workarounds

Apply equivalent filtering at an upstream or downstream enforcement point, such as a firewall or a non-Pseudowire interface where ACL processing is unaffected.
Where feasible, restrict Pseudowire reachability through control-plane policing and infrastructure ACLs on adjacent devices until the fix is deployed.
Reduce exposure by limiting which peers can source traffic into affected Pseudowire circuits through BGP or MPLS policy.

bash

# Verify IOS XR version and inspect Pseudowire interfaces with ingress ACLs
show version
show running-config interface | include Pseudowire|access-group
show access-lists ipv4 usage pfilter location all