Cisco has warned of an active zero-day vulnerability in its router software that’s being exploited in the wild and could allow a remote, authenticated attacker to carry out memory exhaustion attacks on an affected device.
“An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device,” Cisco said in an advisory posted over the weekend.
“A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols.”
Although the company said it will release software fixes to address the flaw, it did not share a timeline for when it plans to make it available. The networking equipment maker said it became aware of attempts to exploit the flaw on August 28.
Tracked as CVE-2020-3566, the severity of the vulnerability has been rated “high” with a Common Vulnerability Scoring System score of 8.6 out of a maximum 10.
The bug affects all Cisco gear running its Internetwork Operating System (IOS) XR Software and stems from an issue in the Distance Vector Multicast Routing Protocol (DVMRP) feature that makes it…
http://feedproxy.google.com/~r/TheHackersNews/~3/iF0sOuFfcwQ/cisco-issue-warning-over-ios-xr-zero.html