PT-2020-3783 · Cisco · Cisco Ios Xr

Published 2020-08-26 · Updated 2025-02-24 · CVE-2020-3569

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software (affected versions not specified)

Description: The issue is related to the incorrect handling of IGMP packets in the Distance Vector Multicast Routing Protocol (DVMRP) feature, which could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. This may negatively impact other processes running on the device, including interior and exterior routing protocols. An attacker could exploit this by sending crafted IGMP traffic to an affected device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

BDU:2020-04145

CVE-2020-3569

Affected Products

Cisco Ios Xr

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2020-3569 · Security Note
• https://bdu.fstec.ru/vul/2020-04145 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3569 · Vendor Advisory
• https://t.me/cvenotify/87448 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3569 · Note
• https://t.me/ckure/5678 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/112275 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2020082902 · Note
• https://t.me/thehackernews/861 · Telegram Post