[ CVE-2009-2055 · Published 19 Aug 2009 ]

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Exploited · CISA KEV CVSS 5.9 EPSS 3%Fix available

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-25

[ Description ]Official description

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

CISA: Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Apr 2022): Apply updates per vendor instructions.

Patch on cisco.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

mailman.nanog.org/pipermail/nanog/2009-August/012719.htmlMailing List
securitytracker.com/idBroken Link
www.cisco.com/en/US/products/products_security_advisory09186a0080af150f.shtmlPatchVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource