CVE-2024-20406: Cisco IOS XR IS-IS Protocol DoS Vulnerability

CVE-2024-20406 Overview

CVE-2024-20406 is a denial of service vulnerability in the segment routing feature for the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS XR Software. An unauthenticated, Layer 2-adjacent attacker can crash the IS-IS process on devices participating in the Flexible Algorithm. The flaw stems from insufficient input validation of ingress IS-IS packets [CWE-20]. Exploitation requires the attacker to first form an IS-IS adjacency with the target. The vulnerability affects segment routing for IS-IS over both IPv4 and IPv6 control planes and applies to devices configured as level 1, level 2, or multi-level routing IS-IS type.

Critical Impact
A successful exploit crashes and restarts the IS-IS process across all affected devices participating in the Flexible Algorithm, producing a network-wide routing outage.

Affected Products

Cisco IOS XR Software (segment routing for IS-IS enabled)
Devices configured as IS-IS level 1, level 2, or multi-level type
Devices participating in IS-IS Flexible Algorithm over IPv4 or IPv6 control planes

Discovery Timeline

2024-09-11 - CVE-2024-20406 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20406

Vulnerability Analysis

The vulnerability resides in the IS-IS protocol implementation within Cisco IOS XR Software, specifically in the segment routing feature and its Flexible Algorithm (Flex-Algo) processing path. Segment routing extends IS-IS with additional Type-Length-Value (TLV) structures used to advertise Segment Identifiers (SIDs) and algorithm participation.

When a malformed IS-IS packet reaches an adjacent device, the parser fails to validate certain fields before acting on them. The IS-IS process aborts and restarts, tearing down existing adjacencies. Because Flex-Algo participants share topology state, the crash propagates across all participating routers, producing a routing plane outage rather than a single-device impact.

The issue is a control-plane input validation failure classified under [CWE-20]. It does not permit code execution or information disclosure, but the availability impact on core routing infrastructure is significant.

Root Cause

The root cause is insufficient input validation of ingress IS-IS Protocol Data Units (PDUs) carrying segment routing TLVs. Malformed or unexpected field values within these PDUs are not sanitized before consumption by the IS-IS process, triggering a fatal condition in the parsing logic.

Attack Vector

Exploitation requires Layer 2 adjacency to the target device and an established IS-IS adjacency. The attacker sends crafted IS-IS packets across the shared link. Because IS-IS operates directly over Layer 2 rather than IP, the attack surface is limited to attackers with a foothold on a directly connected segment such as a compromised peer router, a rogue device on an internet exchange fabric, or a misconfigured lab port. No authentication or user interaction is required once adjacency is formed.

No public proof-of-concept exploit code is available for CVE-2024-20406, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Cisco Security Advisory: ISIS Vulnerability for vendor technical details.

Detection Methods for CVE-2024-20406

Indicators of Compromise

Unexpected isis process restarts recorded in IOS XR syslog or show logging output on routers participating in Flex-Algo.
IS-IS adjacencies transitioning to INIT or DOWN state simultaneously across multiple neighbors without a corresponding link event.
Segment routing SID database churn following ingress of IS-IS PDUs from a single adjacency.

Detection Strategies

Monitor IS-IS adjacency stability with show isis adjacency and alert on repeated flaps on the same interface within short windows.
Ingest IOS XR process crash traces and process_manager events into a SIEM or data lake to correlate IS-IS restarts with peer PDU activity.
Baseline normal Flex-Algo topology change frequency and alert on anomalous IS-IS LSPDB updates.

Monitoring Recommendations

Enable NetFlow, sFlow, or streaming telemetry on links carrying IS-IS to record adjacency state and control-plane packet rates.
Forward IOS XR syslog to a centralized logging platform and create rules for ISIS-3-ADJ_CHANGE and IS-IS process termination messages.
Track physical and logical topology changes against a known-good baseline to surface unexpected adjacency resets.

How to Mitigate CVE-2024-20406

Immediate Actions Required

Identify all IOS XR devices with segment routing for IS-IS and Flexible Algorithm configured using show running-config router isis.
Apply the fixed IOS XR release identified in the Cisco Security Advisory: ISIS Vulnerability.
Restrict Layer 2 access to IS-IS-enabled interfaces and audit all directly connected neighbors.
Enable IS-IS authentication on all adjacencies to reduce the ability of an unauthorized device to form adjacency.

Patch Information

Cisco has published fixed software releases in the vendor advisory cisco-sa-isis-xehpbVNe. Upgrade IOS XR to a release that includes the fix for CVE-2024-20406. There are no fixed-in versions listed in NVD; refer to the Cisco advisory for the exact release matrix that corresponds to your platform and train.

Workarounds

Where operationally viable, disable IS-IS Flexible Algorithm participation until patching is complete.
Enforce IS-IS HMAC-MD5 or keychain-based authentication on all adjacencies to raise the bar for adjacency formation.
Segment management and peering fabrics so that only trusted routers share Layer 2 broadcast domains with IS-IS-enabled interfaces.

bash

# Example: enable IS-IS authentication on an IOS XR interface
router isis CORE
 is-type level-2-only
 net 49.0001.0000.0000.0001.00
 authentication-check
 lsp-password keychain ISIS-KEYCHAIN
 interface TenGigE0/0/0/0
  hello-password keychain ISIS-KEYCHAIN
  address-family ipv4 unicast
  address-family ipv6 unicast