CVE-2009-2055
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session...
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
Exploit likelihood
What each source reports
CVE List
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
- Record
CVE-2009-2055- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2009-2051
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
- Record
EUVD-2009-2051- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2j56-f322-jxrm
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session...
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
- Record
GHSA-2j56-f322-jxrm- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CISA KEV No score
Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
- Record
CVE-2009-2055- Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
- Record
CVE-2009-2055- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2055 is a medium vulnerability (CVSS 4.3) in Cisco Ios Xr, published August 19, 2009. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.31%, the 88th percentile. No source names a fixed version.
References
mailman.nanog.org/pipermail/nanog/2009-August/012719.html
securitytracker.com/id?1022739
cisco.com/en/US/products/products_security_advisory09186a0080af150f.shtml
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-2055
nvd.nist.gov/vuln/detail/CVE-2009-2055
github.com/advisories/GHSA-2j56-f322-jxrm