CVE-2020-3566 - Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Back Back to CVE browser

HIGH KEV

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Published Aug 29, 2020 ·Due May 3, 2022

8.6

HIGH

CVSS 3.1

EPSS 3.70%

Description

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.

Affected products

Vendor Cisco Product Cisco IOS XR Software Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco IOS XR Software

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24837
Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz
vendor-advisoryx_refsource_CISCOVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3566
government-resourceUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24837		Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz		vendor-advisoryx_refsource_CISCOVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3566		government-resourceUS Government Resource