CVE-2020-3569

Warnung

EPSS 3.32%
Veröffentlicht 23.09.2020 01:15:15
Zuletzt bearbeitet 28.10.2025 13:53:47
Erkennungen
Login

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address these vulnerabilities.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 2 Referenzen 5

NVD 14 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Cisco ≫ Ios Xr Version 6.1.4

   Cisco ≫ Asr 9000v Version -
   Cisco ≫ Asr 9001 Version -
   Cisco ≫ Asr 9006 Version -
   Cisco ≫ Asr 9010 Version -
   Cisco ≫ Asr 9901 Version -
   Cisco ≫ Asr 9903 Version -
   Cisco ≫ Asr 9904 Version -
   Cisco ≫ Asr 9906 Version -
   Cisco ≫ Asr 9910 Version -
   Cisco ≫ Asr 9912 Version -
   Cisco ≫ Asr 9922 Version -
   Cisco ≫ Ncs 5001 Version -
   Cisco ≫ Ncs 5002 Version -
   Cisco ≫ Ncs 5011 Version -
   Cisco ≫ Ncs 520 Version -
   Cisco ≫ Ncs 540 Version -
   Cisco ≫ Ncs 5501 Version -
   Cisco ≫ Ncs 5501 Version se
   Cisco ≫ Ncs 5502 Version -
   Cisco ≫ Ncs 5502 Version se
   Cisco ≫ Ncs 5508 Version -
   Cisco ≫ Ncs 5516 Version -
   Cisco ≫ Ncs 560 Version -
   Cisco ≫ Ncs 6008 Version -

Cisco ≫ Ios Xr Version 6.2.3

Cisco ≫ Ios Xr Version 6.3.3

Cisco ≫ Ios Xr Version 6.4.2

Cisco ≫ Ios Xr Version 6.5.3

Cisco ≫ Ios Xr Version 6.6.2

Cisco ≫ Ios Xr Version 6.6.3

Cisco ≫ Ios Xr Version 7.0.2

Cisco ≫ Ios Xr Version 7.1.2

Cisco ≫ Ios Xr Version 7.1.15

Cisco ≫ Ios Xr Version < 6.5.2

   Cisco ≫ Ncs 5001 Version -
   Cisco ≫ Ncs 5002 Version -
   Cisco ≫ Ncs 5011 Version -
   Cisco ≫ Ncs 520 Version -
   Cisco ≫ Ncs 540 Version -
   Cisco ≫ Ncs 5501 Version -
   Cisco ≫ Ncs 5501 Version se
   Cisco ≫ Ncs 5502 Version -
   Cisco ≫ Ncs 5502 Version se
   Cisco ≫ Ncs 5508 Version -
   Cisco ≫ Ncs 5516 Version -
   Cisco ≫ Ncs 560 Version -
   Cisco ≫ Ncs 6008 Version -

Cisco ≫ Ios Xr Version 6.1.4

Cisco ≫ Ios Xr Version 6.4.2

Cisco ≫ Ios Xr Version 6.4.3

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Schwachstelle

Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	3.32%	0.874

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.6	3.9	4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P
Cisco PSIRT	8.6	3.9	4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz

Vendor Advisory

Mitigation

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3569

US Government Resource

https://nvd.nist.gov/vuln/detail/CVE-2020-3569

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-3569

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-3569

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2020-3569

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog