CVE-2020-3569

CVE-2020-3569 is a memory-exhaustion flaw in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR, caused by incorrect handling of IGMP packets. An unauthenticated, remote attacker triggers it by sending crafted IGMP traffic to an affected device, which can immediately crash the IGMP process or drive it to consume available memory until it crashes. Because the exhausted memory is shared, other processes on the router — including interior and exterior routing protocols — can become unstable, making this an availability-only but potentially broad denial-of-service on a core routing device (CVSS 8.6, availability impact high). Any network running Cisco IOS XR, typically on service-provider and large-enterprise routing platforms, is affected; the specific affected and fixed releases are listed in the Cisco advisory. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2021-11-03, and news coverage reports active exploitation of the IOS XR flaws, while no public proof-of-concept is known.

What to do: Apply the fixed Cisco IOS XR software per Cisco's advisory, which is also the required action listed for this CVE in the CISA KEV catalog. As an interim mitigation, restrict or filter untrusted IGMP traffic destined to IOS XR devices (e.g., via ACLs at network edges) and disable DVMRP where it is not needed. Inventory your estate for IOS XR devices with the DVMRP/IGMP feature enabled and prioritize internet- or untrusted-facing routers for patching.