Every CVESearch/Get API key

CVE-2009-2055

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session...

4.3 MediumIn KEV

CVE-2009-2055 is a medium vulnerability (CVSS 4.3) in Cisco Ios Xr, published August 19, 2009. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.31%, the 88th percentile. No source names a fixed version.

Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
3.31%EPSS, 88th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
No fix listedNo source names one

Description

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

Exploit likelihood

3.31%Up 2.2 points since Feb 4, 2022
90%50%10%1%

Affected products

What each source reports

CVE List5.9

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

Record
CVE-2009-2055
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2009-20515.9

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

Record
EUVD-2009-2051
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2j56-f322-jxrm5.9

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session...

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

Record
GHSA-2j56-f322-jxrm
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
CISA KEVNo score

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

Record
CVE-2009-2055
Weakness
CWE-20
Updated
2026-11-02
NVD5.9

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

Record
CVE-2009-2055
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02

History

History
RecordedChangedSources
exploitation
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open