Cisco IOS XE Software is vulnerable to a DHCP snooping flaw that allows unauthenticated remote attackers to cause a Denial of Service by improperly forwarding packets across VLAN boundaries.

The vulnerability resides in the DHCP snooping feature. An unauthenticated, remote attacker can exploit this by sending specific BOOTP packets, causing the device to forward them between VLANs incorrectly, resulting in system instability or a DoS.

This vulnerability undermines network segmentation and can lead to a complete loss of service for affected network segments. A CVSS score of 8.6 confirms a High severity level, as an attacker can disrupt network operations without requiring any valid credentials or local access.

Immediate Action: Apply the relevant Cisco IOS XE security patches immediately to address the DHCP snooping logic error.

Proactive Monitoring: Audit DHCP snooping logs and monitor for unexpected BOOTP traffic patterns originating from untrusted ports.

Compensating Controls: Disable DHCP snooping on interfaces where it is not required, or implement strict VLAN access control lists (VACLs) to limit inter-VLAN traffic.

Public Exploit Available: false

It is strongly recommended to update Cisco IOS XE devices to a fixed release. Maintaining the integrity of DHCP snooping is vital for network security and stability; therefore, applying the primary remediation patch should be prioritized by network security teams.