---
id: "CVE-2020-3566"
kind: "vulnerability"
aliases: ["CVE-2020-3566"]
title: "Cisco IOS XR: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability"
severity: "high"
cvss: 8.6
epss: 0.03702
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco IOS XR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "exploited", "infrastructure", "ios-xr", "network-operators"]
not_affected_if: ["dvmrp-not-enabled", "non-ios-xr-platforms"]
published_at: "2020-08-29T16:15:09+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3566", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-3566", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3566", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Cisco IOS XR: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Cisco IOS XR routers mishandle IGMP packets when DVMRP is in use, so an unauthenticated remote attacker can crash the IGMP process or exhaust its memory until it crashes. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco IOS XR affected ? fixed ?

## Fix

Apply the updates from Cisco's advisory per vendor instructions (CISA requires this; the fixed version is unknown from the sources).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3566
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-3566
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-3566

## From the sources

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_