CVE-2020-3566 Cisco IOS XR Software DVMRP Memory Exhaustion

Exploited in the wild High 8.6 Published 29 Aug 2020 Updated 21 Oct 2025

Remote attackers can exhaust memory on Cisco IOS XR devices via crafted IGMP traffic, causing instability in routing processes.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3566?

CVE-2020-3566 is a high-severity denial of service vulnerability in Cisco Ios Xr, published on 29 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.

Weakness: CWE-770, CWE-400

Which versions are affected by CVE-2020-3566?

It affects 1 product.

Products include Cisco Ios Xr.

How do I fix CVE-2020-3566?

No fix has been published for CVE-2020-3566 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-3566 being exploited?

Yes. Attackers have exploited CVE-2020-3566 in the wild since at least 3 Nov 2021.

All Cisco Ios Xr vulnerabilities

Sources

Also known as GHSA-mr9v-hqxh-vq2j.