---
id: "CVE-2010-3035"
kind: "vulnerability"
aliases: ["CVE-2010-3035"]
title: "Cisco IOS XR: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability"
severity: "high"
cvss: 7.5
epss: 0.05668
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco IOS XR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["bgp", "cisco", "exploited", "infrastructure", "ios-xr", "network-operators"]
not_affected_if: ["bgp-not-configured", "non-ios-xr-platforms"]
published_at: "2010-08-30T21:00:12+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-3035", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-3035", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3035", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Cisco IOS XR: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Cisco IOS XR routers running BGP can be crashed or disrupted by a remote attacker who sends crafted BGP traffic. The attacker gets a denial of service, not code execution or data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco IOS XR affected ? fixed ?

## Fix

Apply the Cisco IOS XR update referenced by the vendor advisory (the sources do not name the fixed version).
Check the advisory at the CISA KEV link for the vendor instructions.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-3035
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-3035
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-3035

## From the sources

Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_