CVE-2020-3569
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
Published Sep 22, 2020 · updated Jun 16, 2026 · cisco ios xr
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address these vulnerabilities.
Timeline
Detection, updates, and resolution for this record.
Sep 22, 2020 · Catalog
Detected
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. The
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. The
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe cisco/ios xrversion unspecified
- cpe cisco/ios xr6.1.4
- cpe cisco/ios xr6.2.3
- cpe cisco/ios xr6.3.3
- cpe cisco/ios xr6.4.2
- cpe cisco/ios xr6.5.3
- cpe cisco/ios xr6.6.2
- cpe cisco/ios xr6.6.3
- cpe cisco/ios xr7.0.2
- vendor Cisco IOS XRversion unspecified
Sources
- CISA KEVCVE-2020-3569
Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.
cisa.gov - CVE.orgCVE-2020-3569
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-3569
30-day exploitation probability 3.3%
first.org - NIST NVDCVE-2020-3569
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memor
nvd.nist.gov