8.6

CVE-2026-20301

Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability

A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt Cisco IOS XE Software
Default Statusunknown
Version 17.2.1a
Status affected
Version 16.12.1y
Status affected
Version 16.12.3s
Status affected
Version 16.7.1b
Status affected
Version 16.6.2
Status affected
Version 16.6.5
Status affected
Version 16.12.1w
Status affected
Version 16.9.1d
Status affected
Version 17.3.1
Status affected
Version 16.9.4c
Status affected
Version 16.7.1
Status affected
Version 17.2.1
Status affected
Version 16.6.8
Status affected
Version 16.9.1b
Status affected
Version 16.9.2s
Status affected
Version 16.12.4
Status affected
Version 16.12.3a
Status affected
Version 17.1.1s
Status affected
Version 16.11.1a
Status affected
Version 16.7.2
Status affected
Version 16.11.1b
Status affected
Version 16.9.1s
Status affected
Version 16.9.3h
Status affected
Version 16.9.1c
Status affected
Version 16.6.5a
Status affected
Version 16.6.3
Status affected
Version 16.10.1f
Status affected
Version 17.2.1v
Status affected
Version 16.8.1e
Status affected
Version 16.9.3a
Status affected
Version 16.12.1a
Status affected
Version 16.12.1x
Status affected
Version 3.16.10aS
Status affected
Version 16.6.4s
Status affected
Version 16.10.1c
Status affected
Version 16.12.3
Status affected
Version 16.11.2
Status affected
Version 16.6.5b
Status affected
Version 16.12.2s
Status affected
Version 16.10.1b
Status affected
Version 16.7.3
Status affected
Version 16.6.7
Status affected
Version 16.9.6
Status affected
Version 16.9.2
Status affected
Version 16.10.1
Status affected
Version 16.12.1t
Status affected
Version 16.9.1
Status affected
Version 16.8.1a
Status affected
Version 3.18.8aSP
Status affected
Version 16.9.3s
Status affected
Version 16.6.7a
Status affected
Version 16.12.2
Status affected
Version 16.11.1
Status affected
Version 16.9.3
Status affected
Version 16.11.1s
Status affected
Version 16.12.1
Status affected
Version 17.1.1
Status affected
Version 17.1.2
Status affected
Version 16.10.1d
Status affected
Version 17.1.1t
Status affected
Version 16.9.4
Status affected
Version 16.8.3
Status affected
Version 16.12.2t
Status affected
Version 16.9.5
Status affected
Version 16.8.1s
Status affected
Version 16.10.1e
Status affected
Version 16.8.2
Status affected
Version 16.6.4
Status affected
Version 16.8.1b
Status affected
Version 16.10.1a
Status affected
Version 16.12.1z
Status affected
Version 16.8.1c
Status affected
Version 16.9.1a
Status affected
Version 16.9.5f
Status affected
Version 16.6.4a
Status affected
Version 16.10.1g
Status affected
Version 16.8.1
Status affected
Version 16.6.6
Status affected
Version 16.9.2a
Status affected
Version 16.8.1d
Status affected
Version 16.10.3
Status affected
Version 16.7.1a
Status affected
Version 16.11.1c
Status affected
Version 16.10.1s
Status affected
Version 17.2.1r
Status affected
Version 17.1.1a
Status affected
Version 16.10.2
Status affected
Version 16.12.2a
Status affected
Version 16.12.1c
Status affected
Version 16.12.1s
Status affected
Version 16.7.4
Status affected
Version 3.18.9SP
Status affected
Version 17.2.2
Status affected
Version 3.11.3E
Status affected
Version 16.9.8
Status affected
Version 16.9.7
Status affected
Version 17.1.3
Status affected
Version 17.3.1a
Status affected
Version 3.11.4E
Status affected
Version 17.3.2a
Status affected
Version 16.12.5
Status affected
Version 17.3.1w
Status affected
Version 17.3.2
Status affected
Version 3.11.3aE
Status affected
Version 17.4.1
Status affected
Version 16.12.4a
Status affected
Version 17.4.1a
Status affected
Version 3.16.10bS
Status affected
Version 17.3.1x
Status affected
Version 17.3.3
Status affected
Version 16.6.9
Status affected
Version 17.2.3
Status affected
Version 17.5.1
Status affected
Version 16.12.1z1
Status affected
Version 16.12.5a
Status affected
Version 17.4.1b
Status affected
Version 17.3.1z
Status affected
Version 16.12.5b
Status affected
Version 17.4.2
Status affected
Version 17.3.3a
Status affected
Version 3.11.5E
Status affected
Version 17.3.5
Status affected
Version 17.3.4
Status affected
Version 17.5.1a
Status affected
Version 16.12.6
Status affected
Version 17.6.1
Status affected
Version 16.12.1z2
Status affected
Version 16.6.10
Status affected
Version 17.3.4a
Status affected
Version 17.6.1a
Status affected
Version 3.8.10cE
Status affected
Version 17.7.1
Status affected
Version 17.6.1x
Status affected
Version 17.6.2
Status affected
Version 16.12.6a
Status affected
Version 17.3.4c
Status affected
Version 17.4.2a
Status affected
Version 17.3.4b
Status affected
Version 17.7.1a
Status affected
Version 16.12.7
Status affected
Version 17.8.1a
Status affected
Version 17.6.3a
Status affected
Version 17.6.3
Status affected
Version 17.7.2
Status affected
Version 17.7.1b
Status affected
Version 17.9.1w
Status affected
Version 17.3.5a
Status affected
Version 17.6.1z
Status affected
Version 3.8.10dE
Status affected
Version 16.12.8
Status affected
Version 17.8.1
Status affected
Version 17.9.1
Status affected
Version 3.11.6E
Status affected
Version 17.6.4
Status affected
Version 3.11.7E
Status affected
Version 17.3.5b
Status affected
Version 17.9.1a
Status affected
Version 17.3.6
Status affected
Version 17.10.1
Status affected
Version 3.11.8E
Status affected
Version 16.9.8a
Status affected
Version 17.6.1z1
Status affected
Version 17.10.1a
Status affected
Version 17.9.2
Status affected
Version 17.6.5
Status affected
Version 17.9.1x
Status affected
Version 17.9.1y
Status affected
Version 16.9.8b
Status affected
Version 17.3.7
Status affected
Version 17.9.2a
Status affected
Version 17.9.3
Status affected
Version 16.12.9
Status affected
Version 17.11.1
Status affected
Version 17.10.1b
Status affected
Version 17.6.6
Status affected
Version 17.9.1x1
Status affected
Version 17.11.1a
Status affected
Version 17.9.3a
Status affected
Version 17.12.1
Status affected
Version 17.3.8
Status affected
Version 17.9.4
Status affected
Version 16.12.10
Status affected
Version 17.12.1w
Status affected
Version 17.9.1y1
Status affected
Version 17.12.1a
Status affected
Version 3.11.9E
Status affected
Version 17.9.5
Status affected
Version 17.13.1
Status affected
Version 17.12.1x
Status affected
Version 17.12.2
Status affected
Version 17.14.1
Status affected
Version 17.9.4a
Status affected
Version 17.3.8a
Status affected
Version 17.6.6a
Status affected
Version 17.6.5a
Status affected
Version 17.6.7
Status affected
Version 16.12.10a
Status affected
Version 17.15.1
Status affected
Version 17.13.1a
Status affected
Version 17.12.2a
Status affected
Version 16.12.11
Status affected
Version 17.12.3
Status affected
Version 17.12.1y
Status affected
Version 3.11.10E
Status affected
Version 17.12.1z
Status affected
Version 17.9.5a
Status affected
Version 17.14.1a
Status affected
Version 17.9.5b
Status affected
Version 17.6.8
Status affected
Version 16.12.12
Status affected
Version 17.12.4
Status affected
Version 17.9.6
Status affected
Version 17.17.1
Status affected
Version 17.16.1
Status affected
Version 17.15.1w
Status affected
Version 17.12.3a
Status affected
Version 3.11.11E
Status affected
Version 17.9.5c
Status affected
Version 17.15.1a
Status affected
Version 17.12.1z1
Status affected
Version 17.15.2
Status affected
Version 17.15.1b
Status affected
Version 17.9.5d
Status affected
Version 17.15.1x
Status affected
Version 17.9.6a
Status affected
Version 17.12.1z2
Status affected
Version 17.6.8a
Status affected
Version 17.16.1a
Status affected
Version 16.12.13
Status affected
Version 17.15.3
Status affected
Version 17.9.7
Status affected
Version 17.12.5
Status affected
Version 17.15.1y
Status affected
Version 17.9.5e
Status affected
Version 17.12.4a
Status affected
Version 17.15.2a
Status affected
Version 17.15.2c
Status affected
Version 17.15.2b
Status affected
Version 17.12.1z3
Status affected
Version 17.9.5f
Status affected
Version 17.12.4b
Status affected
Version 3.11.12E
Status affected
Version 17.12.5a
Status affected
Version 17.18.1
Status affected
Version 17.12.6
Status affected
Version 17.12.1z4
Status affected
Version 17.9.8
Status affected
Version 17.9.7a
Status affected
Version 17.15.3a
Status affected
Version 17.15.4
Status affected
Version 3.11.13E
Status affected
Version 17.12.5b
Status affected
Version 17.15.3b
Status affected
Version 16.12.14
Status affected
Version 17.18.1z
Status affected
Version 17.9.7b
Status affected
Version 17.12.5c
Status affected
Version 26.1.1
Status affected
Version 17.18.1a
Status affected
Version 17.15.4a
Status affected
Version 17.18.2
Status affected
Version 17.18.1w
Status affected
Version 17.15.4b
Status affected
Version 17.12.6a
Status affected
Version 17.12.7
Status affected
Version 17.15.4c
Status affected
Version 17.9.9
Status affected
Version 17.12.5d
Status affected
Version 16.12.15
Status affected
Version 17.15.4s1
Status affected
Version 17.15.5
Status affected
Version 17.12.1z5
Status affected
Version 17.18.1x
Status affected
Version 17.12.1z6
Status affected
Version 17.15.4d
Status affected
Version 17.12.6b
Status affected
Version 17.4.1c
Status affected
Version 3.11.14E
Status affected
Version 17.15.5a
Status affected
Version 17.18.1y
Status affected
Version 17.12.7a
Status affected
Version 17.18.3
Status affected
Version 17.12.7b
Status affected
Version 17.18.3a
Status affected
Version 26.1.1a
Status affected
Version 26.2.1ea
Status affected
Version 16.12.16
Status affected
HerstellerCisco
≫
Produkt IOS
Default Statusunknown
Version 15.2(7)E7
Status affected
Version 15.2(8)E3
Status affected
Version 15.7(3)M10
Status affected
Version 15.8(3)M9
Status affected
Version 15.9(3)M7
Status affected
Version 15.2(7)E8
Status affected
Version 15.2(8)E4
Status affected
Version 15.9(3)M7a
Status affected
Version 15.2(2)E10c
Status affected
Version 15.2(4)E10d
Status affected
Version 15.9(3)M6a
Status affected
Version 15.9(3)M6b
Status affected
Version 15.5(1)SY10
Status affected
Version 15.5(1)SY11
Status affected
Version 15.2(6)E1a
Status affected
Version 15.4(1)SY4
Status affected
Version 15.5(1)SY1
Status affected
Version 15.2(2)E8
Status affected
Version 15.2(6)E1
Status affected
Version 15.7(3)M2
Status affected
Version 15.2(4)E6
Status affected
Version 15.2(1)SY6
Status affected
Version 15.2(4)EA7
Status affected
Version 15.2(6)E1s
Status affected
Version 15.7(3)M3
Status affected
Version 15.8(3)M
Status affected
Version 15.2(1)SY7
Status affected
Version 15.2(4)EA8
Status affected
Version 15.8(3)M0a
Status affected
Version 15.2(2)E9
Status affected
Version 15.2(6)E2
Status affected
Version 15.5(1)SY2
Status affected
Version 15.2(4)E7
Status affected
Version 15.2(6)E2a
Status affected
Version 15.2(2)E9a
Status affected
Version 15.8(3)M0b
Status affected
Version 15.2(6)E2b
Status affected
Version 15.8(3)M1
Status affected
Version 15.8(3)M1a
Status affected
Version 15.7(3)M4
Status affected
Version 15.2(1)SY8
Status affected
Version 15.2(4)E8
Status affected
Version 15.5(1)SY3
Status affected
Version 15.2(7)E
Status affected
Version 15.7(3)M4a
Status affected
Version 15.8(3)M2
Status affected
Version 15.2(7)E0a
Status affected
Version 15.8(3)M2a
Status affected
Version 15.7(3)M4b
Status affected
Version 15.2(2)E10
Status affected
Version 15.2(7)E0s
Status affected
Version 15.2(4)EA9
Status affected
Version 15.2(7)E0b
Status affected
Version 15.2(6)E3
Status affected
Version 15.9(3)M
Status affected
Version 15.8(3)M3
Status affected
Version 15.5(1)SY4
Status affected
Version 15.7(3)M5
Status affected
Version 15.2(2)E10a
Status affected
Version 15.2(4)E9
Status affected
Version 15.2(7)E1
Status affected
Version 15.8(3)M3b
Status affected
Version 15.9(3)M0a
Status affected
Version 15.2(7)E1a
Status affected
Version 15.2(4)E10
Status affected
Version 15.5(1)SY5
Status affected
Version 15.2(4)EA9a
Status affected
Version 15.9(3)M1
Status affected
Version 15.8(3)M4
Status affected
Version 15.7(3)M6
Status affected
Version 15.2(7)E2
Status affected
Version 15.5(1)SY6
Status affected
Version 15.2(7)E3
Status affected
Version 15.8(3)M5
Status affected
Version 15.7(3)M7
Status affected
Version 15.9(3)M2
Status affected
Version 15.2(7)E2b
Status affected
Version 15.9(3)M2a
Status affected
Version 15.2(4)E10a
Status affected
Version 15.2(7)E4
Status affected
Version 15.5(1)SY7
Status affected
Version 15.2(4)E10b
Status affected
Version 15.2(7)E3k
Status affected
Version 15.2(8)E
Status affected
Version 15.9(3)M3
Status affected
Version 15.8(3)M6
Status affected
Version 15.7(3)M8
Status affected
Version 15.8(3)M7
Status affected
Version 15.5(1)SY8
Status affected
Version 15.2(7)E5
Status affected
Version 15.2(8)E1
Status affected
Version 15.9(3)M4
Status affected
Version 15.2(8)E2
Status affected
Version 15.2(4)E10c
Status affected
Version 15.7(3)M9
Status affected
Version 15.2(2)E10b
Status affected
Version 15.2(7)E6
Status affected
Version 15.9(3)M4a
Status affected
Version 15.5(1)SY9
Status affected
Version 15.9(3)M5
Status affected
Version 15.8(3)M8
Status affected
Version 15.9(3)M6
Status affected
Version 15.9(3)M9
Status affected
Version 15.5(1)SY13
Status affected
Version 15.9(3)M8b
Status affected
Version 15.2(7)E9
Status affected
Version 15.5(1)SY12
Status affected
Version 15.7(3)M10a
Status affected
Version 15.9(3)M8
Status affected
Version 15.9(3)M8a
Status affected
Version 15.2(8)E5
Status affected
Version 15.2(7)E10
Status affected
Version 15.7(3)M10b
Status affected
Version 15.9(3)M3a
Status affected
Version 15.8(3)M3a
Status affected
Version 15.9(3)M3b
Status affected
Version 15.6(2)SP7
Status affected
Version 15.6(2)SP5
Status affected
Version 15.6(2)SP8
Status affected
Version 15.6(2)SP6
Status affected
Version 15.6(2)SP4
Status affected
Version 15.6(2)SP9
Status affected
Version 15.6(2)SP8a
Status affected
Version 15.9(3)M9a
Status affected
Version 15.2(8)E6
Status affected
Version 15.9(3)M10
Status affected
Version 15.2(7)E11
Status affected
Version 15.5(1)SY14
Status affected
Version 15.2(8)E7
Status affected
Version 15.2(4)E10e
Status affected
Version 15.9(3)M11
Status affected
Version 15.2(7)E12
Status affected
Version 15.5(1)SY15
Status affected
Version 15.2(8)E8
Status affected
Version 15.5(1)SY16
Status affected
Version 15.2(7)E13
Status affected
Version 15.9(3)M12
Status affected
Version 15.5(1)SY17
Status affected
Version 15.2(7)E14
Status affected
Version 15.9(3)M13
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.252
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cisco PSIRT 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-606 Unchecked Input for Loop Condition

The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t