CVE-2020-3566 — Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

provenance: imported · CVE: CVE-2020-3566

CVE-2020-3566: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Cisco
Product	IOS XR
Date added	2021-11-03
Due date	2022-05-03
Ransomware campaign use	Unknown

Description

Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-3566

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-3566
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog