CVE-2024-20390

A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could exploit this vulnerability by sending a sustained, crafted stream of XML traffic to a targeted device. A successful exploit could allow the attacker to cause XML TCP port 38751 to become unreachable while the attack traffic persists.

• CWE-940

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-xml-tcpdos-ZEXvrU2SVendor Advisory

Published

Sep 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-20385A vulnerability in the SSL/TLS implementation of Cisco Nexus…5.9
• CVE-2024-20386A vulnerability in the web-based management interface of Cis…6.1
• CVE-2024-20387A vulnerability in the web-based management interface of Cis…5.4
• CVE-2024-20388A vulnerability in the password change feature of Cisco Fire…5.3
• CVE-2024-20389A vulnerability in the ConfD CLI and the Cisco Crosswork Ne…7.8
• CVE-2024-2039The Stackable – Page Builder Gutenberg Blocks plugin for Wor…6.4
• CVE-2024-20391A vulnerability in the Network Access Manager (NAM) module o…6.8
• CVE-2024-20392A vulnerability in the web-based management API of Cisco Asy…6.1
• CVE-2024-20393A vulnerability in the web-based management interface of Cis…8.8
• CVE-2024-20394A vulnerability in Cisco AppDynamics Network Visibility Agen…5.5
• CVE-2024-20395A vulnerability in the media retrieval functionality of Cisc…7.3
• CVE-2024-20396A vulnerability in the protocol handlers of Cisco Webex App …6.5