{"id":"CVE-2020-3566","kind":"vulnerability","aliases":["CVE-2020-3566"],"related":[],"title":"Cisco IOS XR: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability","description":"A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.","summary":"Cisco IOS XR routers mishandle IGMP packets when DVMRP is in use, so an unauthenticated remote attacker can crash the IGMP process or exhaust its memory until it crashes. CISA lists it as actively exploited in the wild.","severity":"high","cvss":8.6,"epss":0.03702,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Cisco IOS XR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","infrastructure","ios-xr","network-operators"],"not_affected_if":["dvmrp-not-enabled","non-ios-xr-platforms"],"how_to_check":null,"fix":"Apply the updates from Cisco's advisory per vendor instructions (CISA requires this; the fixed version is unknown from the sources).","status":"open","published_at":"2020-08-29T16:15:09+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:51+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:33:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates from Cisco's advisory per vendor instructions (CISA requires this; the fixed version is unknown from the sources).","reach":"network","impact":"medium","summary":"Cisco IOS XR routers mishandle IGMP packets when DVMRP is in use, so an unauthenticated remote attacker can crash the IGMP process or exhaust its memory until it crashes. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["cisco","ios-xr","network-operators"],"confidence":0.6,"needs_auth":"no","worst_case":"Routing multicast process crashes or exhausts memory, disrupting network traffic.","analyst_note":"Find the affected and fixed IOS XR versions and the DVMRP config check in Cisco's advisory for CVE-2020-3566; sources given here do not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["dvmrp-not-enabled","non-ios-xr-platforms"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000484,"input_tokens":2897,"output_tokens":389,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed IOS XR versions and the DVMRP config check in Cisco's advisory for CVE-2020-3566; sources given here do not list them.","search":"'-2020':13A,16A '-3566':14A,17A 'activ':63B 'address':165C 'affect':96C,126C 'allow':85C,132C 'attack':46B,89C,114C,134C 'caus':136C 'cisa':59B 'cisco':1A,4A,18A,21B,30B,80C,159C 'could':84C,115C,131C 'craft':121C 'crash':48B,58B 'cve':12A,15A 'devic':97C,127C 'distanc':72C 'due':101C 'dvmrp':8A,38B,77C 'exhaust':10A,53B,91C,138C 'exploit':22B,64B,116C,130C 'exterior':156C 'featur':78C 'group':108C 'igmp':35B,50B,111C,122C 'includ':148C 'infrastructur':23B 'instabl':141C 'insuffici':103C 'interior':154C 'internet':107C 'io':2A,5A,25B,31B,81C 'ios':19A 'ios-xr':24B 'limit':152C 'list':60B 'manag':105C,109C 'may':147C 'memori':9A,55B,93C,137C 'mishandl':34B 'multicast':74C 'network':28B 'network-oper':27B 'oper':29B 'packet':36B,112C 'process':51B,92C,144C,146C 'protocol':76C,110C,158C 'queue':104C 'releas':161C 'remot':45B,88C 'result':139C 'rout':75C,157C 'router':33B 'send':120C 'softwar':7A,83C,162C 'success':129C 'traffic':123C 'unauthent':44B,87C 'updat':163C 'use':41B 'vector':73C 'vulner':11A,69C,99C,118C,167C 'wild':67B 'xr':3A,6A,20A,26B,32B,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-08-29T16:15:09+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-3566","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3566","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2020-3566","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-3566","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-3566","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3566","severity":null,"published_at":"2020-08-29T16:15:09+00:00","modified_at":"2026-06-17T03:18:36+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}