CVE-2009-2055

Timeline

Detection, updates, and resolution for this record.

1. Aug 19, 2009 · Catalog

   Detected

   Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

2. Mar 25, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Apr 15, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

Affected

• cpe cisco/ios xr3.4
• cpe cisco/ios xr3.4.0
• cpe cisco/ios xr3.4.1
• cpe cisco/ios xr3.4.2
• cpe cisco/ios xr3.4.3
• cpe cisco/ios xr3.5
• cpe cisco/ios xr3.5.2
• cpe cisco/ios xr3.5.3
• vendor Cisco IOS XRversion unspecified

Sources

• CISA KEVCVE-2009-2055

  Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

  cisa.gov
• CVE.orgCVE-2009-2055

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2009-2055

  30-day exploitation probability 3.3%

  first.org
• NIST NVDCVE-2009-2055

  Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

  nvd.nist.gov

References

• Mailing List · mailman.nanog.org
• Broken Link · securitytracker.com
• Patch · cisco.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov