CVE-2010-3035

KEVCisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Description

Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

PublishedAug 30, 2010

Last modifiedJun 16, 2026

Added to KEVMar 25, 2022

Remediation dueApr 15, 2022

References

mailman.nanog.org/pipermail/nanog/2010-August/024837.htmlMailing List
osvdb.org/67696Broken Link
secunia.com/advisories/41190Broken Link
cisco.com/en/US/products/products_security_advisory09186a0080b4411f.shtmlBroken LinkVendor Advisory
securitytracker.com/id?1024371Broken LinkThird Party Advisory
vupen.com/english/advisories/2010/2227Broken Link
exchange.xforce.ibmcloud.com/vulnerabilities/61443VDB EntryVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3035US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1655 days
CVSS: 7.5 HIGH
EPSS (30-day exploit probability): 5.7% · top 7% of all CVEs
Weakness: NVD-CWE-noinfo
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.