CVE-2020-3449: Cisco IOS XR Software Additional Paths Denial of Service Vulnerability

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-17 · updated 2026-06-17
Weakness: CWE-754

Description

A vulnerability in the Border Gateway Protocol (BGP) additional paths feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent authorized users from monitoring the BGP status and cause the BGP process to stop processing new updates, resulting in a denial of service (DOS) condition. The vulnerability is due to an incorrect calculation of lexicographical order when displaying additional path information within Cisco IOS XR Software, which causes an infinite loop. An attacker could exploit this vulnerability by sending a specific BGP update from a BGP neighbor peer session of an affected device; an authorized user must then issue a show bgp command for the vulnerability to be exploited. A successful exploit could allow the attacker to prevent authorized users from properly monitoring the BGP status and prevent BGP from processing new updates, resulting in outdated information in the routing and forwarding tables.

Affected products

Cisco IOS XR Software: before 7.1.2; from 7.2.0 before 7.2.1; from 7.3.0 before 7.3.1 — fixed in 7.1.2, 7.2.1, 7.3.1

How to fix

Upgrade to a fixed version: Cisco IOS XR Software 7.1.2, 7.2.1, 7.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3449 or the next vulnerability affects your stack