CVE Watch—

CVE-2020-3118

Cisco IOS XR Software Discovery Protocol Format String Vulnerability

CVSS

—

No CVSS

EPSS

11.7%

p96

KEV

YES

Nov 3, 2021

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

11.7%EPSS · 30 days11.7%

2026-09-172026-10-15

KEV catalog record

Product

Cisco / IOS XR

Vulnerability

Cisco IOS XR Software Discovery Protocol Format String Vulnerability

Added to KEV

Nov 3, 2021

Remediate by

May 3, 2022

Known ransomware use

Summary description

Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-3118

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2022-20821—

96.0%

KEV—79Cisco IOS XR Open Port Vulnerability—CVE-2010-3035—

92.9%

KEV—78Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability—CVE-2020-3566—

89.6%

KEV—77Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability—CVE-2020-3569—

88.4%

KEV—77Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability—CVE-2009-2055—

88.4%

KEV—77Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability—