HIGH🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-3566

CVSS 8.6v3.1pub. 2020-08-29upd. 2025-10-28

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Cisco Asr 9001
HW
Cisco
all versions
Cisco Asr 9006
HW
Cisco
all versions
Cisco Asr 9010
HW
Cisco
all versions
Cisco Asr 9901
HW
Cisco
all versions
Cisco Asr 9904
HW
Cisco
all versions
Cisco Asr 9906
HW
Cisco
all versions
Cisco Asr 9910
HW
Cisco
all versions
Cisco Asr 9912
HW
Cisco
all versions
Cisco Asr 9922
HW
Cisco
all versions
Cisco IOS XR
OS
Cisco
6.4.2

CISA KEV — detailsi

Vendori: Cisco ↗
Producti: IOS XR
Added to KEVi: November 3, 2021
Remediation deadline (US Federal)i: May 3, 2022(overdue)

🔧Advisory Cisco↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.

🔴