Cisco · IOS XR
CVE-2009-2055
Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Exploited in attacks
Medium 5.9 Attack chance: 3.3%
What it is
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
CISA: Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 15, 2022
More exploited flaws from Cisco
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 23, 2022 | Open Port | IOS XR | Medium 6.5 | 11% |
| Mar 25, 2022 | Border Gateway Protocol (BGP) Denial-of-Service | IOS XR | High 7.5 | 5.7% |
| Nov 3, 2021 | Software Discovery Protocol Format String | IOS XR | High 8.8 | 12% |
| Nov 3, 2021 | Software DVMRP Memory Exhaustion | IOS XR | High 8.6 | 3.7% |
| Nov 3, 2021 | Software DVMRP Memory Exhaustion | IOS XR | High 8.6 | 3.3% |
| Oct 14, 2026 | Relative Path Traversal | Secure Email Gateway | Critical 9.8 | 2.2% |
| Sep 30, 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critical 9.8 | 39% |
| Sep 16, 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critical 10.0 | 76% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.