CVE-2020-3118highunder attackCWE-134

CVE-2020-3118: high-severity vulnerability in Cisco IOS XR Software

Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability

Published · Updated

Follow this CVE+ Monitor Cisco IOS XR

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

76Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 12%
from disclosure to weapon
Published on NVDFeb 5
CISA KEV+637d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Cisco IOS XR's Cisco Discovery Protocol allows an attacker on the same local network to crash the device or run malicious code by sending a specially crafted network packet. This happens because the software doesn't properly check the content of certain fields in these protocol messages.

Technical detail

A format string vulnerability in the CDP implementation of Cisco IOS XR Software allows an unauthenticated, Layer 2 adjacent attacker to trigger a stack overflow via malicious CDP packets with improper input validation in message fields. Successful exploitation permits arbitrary code execution with administrative privileges or device reload. The attack requires network presence in the same broadcast domain but no authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco IOS XR Software
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco IOS XR Software

In the same product, most dangerous first.

CVE-2022-20821MEDIUMCisco IOS XR Software Health Check Open Port VulnerabilityEPSS 11.5%KEVCVE-2020-3566HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityEPSS 3.7%KEVCVE-2020-3569HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesEPSS 3.3%KEVCVE-2025-20363CRITICALCVE-2025-20363EPSS 7.2%CVE-2020-3284HIGHCisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution VulnerabilityEPSS 2.9%CVE-2019-1710CRITICALCisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation VulnerabilityEPSS 2.8%