CVE-2009-2055
Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Description
CVE-2009-2055 is a medium-severity input validation vulnerability affecting Cisco IOS XR (versions 3.4; 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.5; 3.5.2; 3.5.3; 3.5.4; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.8.0; 3.8.1). Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). CISA has added CVE-2009-2055 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 0.41% (61.0th percentile), this vulnerability has a moderate probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios xr | 3.4; 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.5; 3.5.2; 3.5.3; 3.5.4; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.8.0; 3.8.1 |
References
- http://mailman.nanog.org/pipermail/nanog/2009-August/012719.html(Mailing List)
- http://securitytracker.com/id?1022739(Broken Link)
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080af150f.shtml(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-2055(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation is a software weakness where a product receives input or data but does not validate or incorrectly validates that the input has the properties required to process data safely and correctly. This vulnerability occurs when applications accept user-supplied data without verifying that it conforms to expected formats, lengths, types, or ranges. In the case of CVE-2009-2055, this weakness manifests in Cisco IOS XR where cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2009-2055 affects Cisco IOS XR with a CVSS score of 5.9, indicating a moderate but meaningful security risk. While confidentiality and integrity are not directly affected, the availability impact is high — successful exploitation can cause complete denial of service, disrupting critical business operations. The network-based attack vector requiring no authentication makes this vulnerability particularly accessible to opportunistic attackers and automated scanning tools.
Exploit Maturity
CVE-2009-2055 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 0.41% (61.0th percentile) suggests a moderate but real exploitation probability. Despite being over 17 years old, this vulnerability continues to be relevant due to the persistence of unpatched legacy systems in production environments.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade Cisco IOS XR from affected versions (3.4; 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.5; 3.5.2; 3.5.3; 3.5.4; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.8.0; 3.8.1) to the latest patched release.
- If immediate patching is not possible, restrict network access to the affected IOS XR service using firewall rules, ACLs, or network segmentation to limit exposure to trusted networks only.
- Monitor affected systems for signs of compromise by reviewing security logs for anomalous activity, unauthorized access attempts, and unexpected system changes related to IOS XR.
- Evaluate whether affected Cisco IOS XR deployments are still within vendor support. End-of-life systems should be prioritized for migration to supported alternatives.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-15 are addressed within the required timeframe.
Technical Details
CVE-2009-2055 is classified under CWE-20 (Improper Input Validation) affecting Cisco IOS XR in versions 3.4; 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.5; 3.5.2; 3.5.3; 3.5.4; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.8.0; 3.8.1. Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS). The vulnerability is exploitable remotely over the network, though the attack complexity is high, requiring specific conditions to be met, requiring no prior authentication. The CVSS 3.1 base score of 5.9 (MEDIUM) reflects no confidentiality impact, no integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2009-2055 being actively exploited?
Yes. CVE-2009-2055 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 0.41% (61.0th percentile) indicates a notable probability of exploitation.
What products are affected by CVE-2009-2055?
CVE-2009-2055 primarily affects Cisco IOS XR. The affected versions include 3.4; 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.5; 3.5.2; 3.5.3; 3.5.4; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.8.0; 3.8.1. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2009-2055?
Apply updates per vendor instructions. Specifically, upgrade from the affected versions (3.4; 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.5; 3.5.2; 3.5.3; 3.5.4; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.8.0; 3.8.1) to the latest patched release from Cisco. As an interim measure, restrict network access to the affected service to trusted networks only.
How severe is CVE-2009-2055?
CVE-2009-2055 has a CVSS 3.1 score of 5.9, rated MEDIUM. While rated medium, the inclusion in the CISA KEV catalog underscores the real-world exploitability of this issue. The inclusion in the CISA KEV catalog means organizations are required to remediate this vulnerability within the specified deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.