CVE-2026-20084 Overview
A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of BOOTP packets on Cisco Catalyst 9000 Series Switches. An attacker could exploit this vulnerability by sending BOOTP request packets to an affected device, causing BOOTP VLAN leakage and potentially leading to high CPU utilization that renders the device unreachable and unable to forward traffic.
Critical Impact
Successful exploitation allows unauthenticated remote attackers to cause complete denial of service on Cisco Catalyst 9000 Series Switches by triggering BOOTP VLAN leakage and CPU exhaustion, making devices unreachable via console or remote management.
Affected Products
- Cisco IOS XE Software
- Cisco Catalyst 9000 Series Switches
- Devices with DHCP snooping feature enabled
Discovery Timeline
- 2026-03-25 - CVE CVE-2026-20084 published to NVD
- 2026-03-26 - Last updated in NVD database
Technical Details for CVE-2026-20084
Vulnerability Analysis
This denial of service vulnerability stems from improper handling of BOOTP packets within the DHCP snooping feature of Cisco IOS XE Software. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the flaw allows attackers to exhaust system resources through malicious input.
When DHCP snooping is enabled on Cisco Catalyst 9000 Series Switches, the system is expected to inspect and filter DHCP/BOOTP traffic to prevent rogue DHCP servers and other DHCP-based attacks. However, due to the improper packet handling logic, specially crafted BOOTP request packets bypass the intended VLAN isolation, causing packets to be forwarded between VLANs inappropriately.
The vulnerability can be exploited using either unicast or broadcast BOOTP packets, which broadens the attack surface significantly. Once exploitation begins, the affected device experiences high CPU utilization, ultimately becoming unresponsive to both console access and remote management interfaces while also failing to forward legitimate network traffic.
Root Cause
The root cause of this vulnerability is improper validation and handling of BOOTP packets within the DHCP snooping feature implementation. The DHCP snooping module fails to properly enforce VLAN boundaries when processing BOOTP request packets, allowing traffic leakage between network segments. This improper packet handling leads to resource exhaustion conditions when the device attempts to process and forward packets inappropriately across VLANs.
Attack Vector
The attack vector is network-based, requiring no authentication or user interaction. An attacker with network access to an affected Cisco Catalyst 9000 Series Switch can send malicious BOOTP request packets to trigger the vulnerability. The attack can be executed using either:
- Unicast BOOTP packets - Targeted directly at the switch
- Broadcast BOOTP packets - Sent across the network segment
The exploitation causes BOOTP packets to leak between VLANs, which in turn triggers high CPU utilization. As resources become exhausted, the switch becomes unreachable through both console and remote management interfaces, and ceases to forward legitimate network traffic, resulting in a complete denial of service condition.
The vulnerability does not require the attacker to have any prior knowledge of the network configuration, making it particularly dangerous in environments where the DHCP snooping feature is enabled on Catalyst 9000 Series infrastructure.
Detection Methods for CVE-2026-20084
Indicators of Compromise
- Unexpected BOOTP/DHCP traffic appearing on VLANs that should not contain such traffic
- Abnormal CPU utilization spikes on Cisco Catalyst 9000 Series Switches
- Loss of console and remote management accessibility to switch infrastructure
- Network traffic forwarding failures coinciding with BOOTP packet activity
Detection Strategies
- Monitor for anomalous BOOTP request packet volumes targeting switch management interfaces
- Implement SIEM alerting rules for sudden CPU utilization increases on Cisco IOS XE devices
- Configure network monitoring to detect BOOTP traffic crossing VLAN boundaries
- Deploy intrusion detection systems with signatures for malformed or excessive BOOTP requests
Monitoring Recommendations
- Enable detailed logging of DHCP snooping events on Cisco Catalyst 9000 switches
- Configure SNMP traps for high CPU utilization thresholds on network infrastructure
- Implement netflow or similar traffic analysis to baseline and monitor BOOTP traffic patterns
- Establish alerting for loss of management connectivity to critical switch infrastructure
How to Mitigate CVE-2026-20084
Immediate Actions Required
- Review the Cisco Security Advisory for patch availability and deployment guidance
- Identify all Cisco Catalyst 9000 Series Switches running vulnerable versions of IOS XE Software
- Implement available workarounds on affected devices until patches can be applied
- Prioritize patching of switches in critical network segments with external exposure
Patch Information
Cisco has acknowledged this vulnerability and workarounds are available to address it. Organizations should consult the Cisco Security Advisory for specific patch details, fixed software versions, and upgrade paths. Apply patches during scheduled maintenance windows following your organization's change management procedures.
Workarounds
- Implement access control lists (ACLs) to filter BOOTP traffic at network boundaries
- Consider disabling DHCP snooping on affected devices if the feature is not critical to operations
- Segment network architecture to limit exposure of Catalyst 9000 switches to untrusted traffic
- Deploy rate limiting for BOOTP/DHCP traffic to reduce the impact of potential exploitation attempts
# Example ACL to filter BOOTP traffic on Cisco IOS XE
# Consult Cisco Security Advisory for specific workaround configurations
# https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bootp-WuBhNBxA
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
