Is CVE-2024-20278 being actively exploited?

CVE-2024-20278 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2024-20278?

CVE-2024-20278 has a CVSS 3.1 base score of 6.5 (MEDIUM).

CVE-2024-20278

MEDIUM · CVSS 6.5EPSS 0.5%EU EUVD

A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root.

Key facts

CVSS score: 6.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-184
EPSS score: 0.5% (44th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2024-17993)
Published: March 27, 2024
NVD last modified: June 17, 2026
Status: Analyzed

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2024-17993 in the EU Vulnerability Database. Last updated in EUVD on August 15, 2024.

View on the EU Vulnerability Database

Affected products

cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe

Certified products that may be affected

5 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Embedded Services 9300 and 3300 Series Switches (ESS9300 & ESS3300) running IOS-XE 17.12 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11521-2025 - active
Cisco cEdge Routers running IOS XE 17.12 with SD-WAN 20.12 - Cisco Systems, Inc. - Common Criteria 654-LSS - active
Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches running IOS-XE 17.12 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11490-2024 - archived
Cisco Catalyst Industrial Ethernet 9300 Rugged Series Switches running IOS-XE 17.12 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11466-2024 - archived
Cisco Catalyst Industrial Ethernet 3200, 3300, 3400, 3400H (IE3x00) Rugged Series Switches running IOS-XE 17.12 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11443-2024 - archived

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain