Read the docs
TI-2024-13374 Aliases CVE-2024-20446GHSA-pwqf-cgf8-rx4x

Cisco NX-OS Software DHCPv6 Relay Agent Denial of Service Vulnerability

Priority MEDIUM 45CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A vulnerability in the DHCPv6 relay agent of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of specific fields in a DHCPv6 RELAY-REPLY message. An attacker could exploit this vulnerability by sending a crafted DHCPv6 packet to any IPv6 address that is configured on an affected device. A successful exploit could allow the attacker to cause the dhcp_snoop process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00784 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco NX-OS Software10.2(1); 10.2(1q); 9.3(9); 8.2(11)—No fix listedCNA
  • Cisco NX-OS Software VendorCisco Affected 10.2(1); 10.2(1q); 9.3(9); 8.2(11) Fixed in — No fix listed CNA

CPE names CISA-ADP · 4

CPEVersionsRoleVendor
cpe:2.3:o:cisco:nx-os:10.2\(1\):*:*:*:*:*:*:*10.2(1)—Cisco
cpe:2.3:o:cisco:nx-os:10.2\(1q\):*:*:*:*:*:*:*10.2(1q)—Cisco
cpe:2.3:o:cisco:nx-os:9.3\(9\):*:*:*:*:*:*:*9.3(9)—Cisco
cpe:2.3:o:cisco:nx-os:8.2\(11\):*:*:*:*:*:*:*8.2(11)—Cisco
  • cpe:2.3:o:cisco:nx-os:10.2\(1\):*:*:*:*:*:*:* Versions 10.2(1) — ·Cisco
  • cpe:2.3:o:cisco:nx-os:10.2\(1q\):*:*:*:*:*:*:* Versions 10.2(1q) — ·Cisco
  • cpe:2.3:o:cisco:nx-os:9.3\(9\):*:*:*:*:*:*:* Versions 9.3(9) — ·Cisco
  • cpe:2.3:o:cisco:nx-os:8.2\(11\):*:*:*:*:*:*:* Versions 8.2(11) — ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-20446
  2. 2026-10-03 Alias added: GHSA-pwqf-cgf8-rx4x

References

Other 1

  • TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 7059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences