{"id":"CVE-2010-3035","aliases":["EUVD-2010-3037","GHSA-9q29-g37m-5wmp"],"status":"published","title":"Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized...","description":"Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05668,"percentile":0.93034,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2010-08-30T20:00:00Z","modified":"2026-06-16T23:22:00Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"products":[{"vendor":"cisco","product":"ios xr"},{"vendor":"cisco","product":"ios_xr"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/61443","tags":["vdb-entry","x_refsource_XF","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id?1024371","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4411f.shtml","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Broken Link","Vendor Advisory"]},{"url":"http://mailman.nanog.org/pipermail/nanog/2010-August/024837.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List"]},{"url":"http://secunia.com/advisories/41190","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2010/2227","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link"]},{"url":"http://osvdb.org/67696","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3035","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3035"},{"url":"https://github.com/advisories/GHSA-9q29-g37m-5wmp"}],"sources":{"cve":[{"id":"CVE-2010-3035","description":"Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.","status":"published","published":"2010-08-30T20:00:00Z","modified":"2026-01-12T20:41:35.367Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:33:28.115387Z"}],"euvd":[{"id":"EUVD-2010-3037","description":"Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.","status":"published","published":"2010-08-30T20:00:00Z","modified":"2026-01-12T20:41:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T19:48:53.22038Z"}],"ghsa":[{"id":"GHSA-9q29-g37m-5wmp","title":"Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized...","description":"Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.","status":"published","published":"2022-05-17T02:05:47Z","modified":"2025-10-22T03:31:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:04:09.843024Z"}],"kev":[{"id":"CVE-2010-3035","title":"Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability","description":"Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).","cwes":["CWE-20"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2010-3035","description":"Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.","status":"published","published":"2010-08-30T21:00:12.203Z","modified":"2026-06-16T23:22:00.63Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:52.227027Z"}]}}