CVE-2020-3566 — HIGH (8.6) — White Hats Nepal

Vulnerability Description

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.

CVSS Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Cisco	Ios Xr	6.4.2
Cisco	Asr 9001	-
Cisco	Asr 9006	-
Cisco	Asr 9010	-
Cisco	Asr 9901	-
Cisco	Asr 9904	-
Cisco	Asr 9906	-
Cisco	Asr 9910	-
Cisco	Asr 9912	-
Cisco	Asr 9922	-

Related Weaknesses (CWE)

CWE-770 CWE-400

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iVendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-US Government Resource

FAQ

What is CVE-2020-3566?

CVE-2020-3566 is a vulnerability with a CVSS score of 8.6 (HIGH). A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected devi...

How severe is CVE-2020-3566?

CVE-2020-3566 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-3566?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xr, Cisco Asr 9001, Cisco Asr 9006, Cisco Asr 9010, Cisco Asr 9901.