Log in Start free

Actively exploited · Published Aug 30, 2010 · Assigned by cisco

CVE-2010-3035

High 7.5 Exploited

In plain English

A high-severity security flaw in IOS XR from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 5.7% (higher than 93% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)5.7%top 7.0% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References