EUVD-2026-70205
GHSA-jp29-xjv5-g87x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish adjacent network position
-
DeliveryCraft malformed protocol/data-plane packets
-
ExploitSend to IOS XR processing path
-
ExecutionTrigger incorrect calculation (CWE-682)
-
PersistCorrupt device memory/control flow
-
ImpactAchieve full C:H/I:H/A:H device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Calculation correctness
|
| Exploitation Conditions | Adjacent network access is required (AV:A) - the attacker must be able to send traffic directly to the target device on the same network segment or via a direct peering relationship; remote internet-based exploitation is not possible without lateral movement to an adjacent position. No authentication is required (PR:N) and no user interaction is needed (UI:N). The description groups multiple incorrect calculation sub-issues (CWE-682) without specifying which IOS XR features or protocols are affected, so the exact triggering condition (e.g., a specific routing protocol, interface type, or feature enabled by configuration) is not determinable from available CVE data alone. Operators should review the Cisco advisory for feature-specific prerequisites. Exploitation is not limited to a specific platform - the wildcard CPE covers all IOS XR deployments. |
| Impact | The CVSS base score of 8.8 with AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a serious but adjacency-constrained risk. The AV:A constraint is meaningful: an attacker must be on the same network segment or have a direct peering relationship, limiting exposure compared to an internet-facing AV:N flaw. No EPSS score was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified. The internal discovery origin (Cisco's own engineering team) is a positive signal - it suggests the vulnerability was not first found and exploited externally. That said, service-provider backbone devices are high-value targets where adjacent access is achievable via peering relationships, BGP sessions, or breached upstream hosts, making the real-world risk higher than for a typical enterprise LAN-only flaw. The full C:H/I:H/A:H triad indicates that successful exploitation could give an attacker complete control over the routing platform, with cascading impact on the networks it serves. |
| Exploit ScenarioDerived | An attacker with adjacent network access - for example via a BGP peering session, a shared MPLS segment, or a compromised upstream router - sends specially crafted protocol messages designed to trigger the incorrect calculation flaw in IOS XR. The arithmetic error corrupts internal state or memory, ultimately allowing the attacker to hijack execution and achieve full device compromise including configuration exfiltration and persistent backdoor installation. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacent network segment to achieve full confidentiality, integrity, and availability compromise of the affected device, as reflected by the CVSS 8.8 AV:A/PR:N/C:H/I:H/A:H vector. The vulnerabilities were discovered through an internal Cisco engineering security review and addressed in a software hardening release; no external exploitation has been reported. Given that IOS XR underpins carrier-grade routers and service-provider backbone infrastructure, successful exploitation could be highly disruptive to network operations.
RemediationAI
The primary remediation is to upgrade Cisco IOS XR Software to a fixed release identified in Cisco Security Advisory cisco-sa-hardening-iosxr-qg64NcM (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM). Specific fixed version numbers are not available in the CVE record and must be retrieved from the advisory. As a compensating control while planning the upgrade, operators should restrict which adjacent hosts or peers can send traffic to the affected protocol processing paths - for example, tightening BGP neighbor ACLs, applying Infrastructure ACLs (iACL) to limit management-plane and control-plane reachability to only trusted IP ranges, and enabling Control Plane Policing (CoPP) where available. These mitigations reduce attack surface but do not eliminate the underlying vulnerability; patching remains the required long-term fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco IOS XR is the operating system used on Cisco's high-end carrier and service-provider routing platforms (ASR 9000, NCS series, CRS, etc.). CWE-682 (Incorrect Calculation) is a broad class covering integer overflow, underflow, wrap-around, off-by-one, and similar arithmetic errors that can corrupt memory state, cause control flow deviations, or enable denial of service. The affected CPE (cpe:2.3:a:cisco:cisco_ios_xr_software:*:*:*:*:*:*:*:*) covers all versions, indicating the issue predates the hardening releases and is likely rooted in long-standing protocol parsing or data-plane processing code paths. The adjacent-network attack vector (AV:A) suggests the vulnerable calculation is triggered via protocols or frames received on a directly connected interface or Layer-2 segment, consistent with how IOS XR handles routing protocol messages, MPLS, or management-plane traffic.
Know when Cisco Ios Xr Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent attack vector and no-auth (PR:N) are consistent with control-plane/protocol processing reachable from peering or local-segment hosts; full C:H/I:H/A:H reflects complete device compromise potential from arithmetic corruption.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20275 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-682.
Executive ViewAI
Cisco IOS XR Software contains calculation logic errors (CWE-682) that allow unauthenticated attackers on adjacent network segments to achieve complete compromise of affected devices, including control of carrier-grade routers foundational to service-provider backbone operations. Organizations running IOS XR deployments face potential network-wide disruption and loss of confidentiality and integrity across critical infrastructure. This vulnerability poses immediate operational risk to any ISP or enterprise with backbone routing dependencies.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce network segmentation and access control lists to restrict management and routing-plane access from adjacent segments to designated trusted administrative networks; (2) deploy out-of-band management access via segregated management networks; (3) implement continuous monitoring and alerting for unexpected device configuration changes and anomalous control-plane traffic; (4) maintain current backup configurations and disaster-recovery procedures for rapid device restoration if compromise is suspected. Continue monitoring Cisco Security Advisories for patch availability and deployment timelines.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Cisco Ios Xr Software
View allImproper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening releas
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restric
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privile
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker
Insufficient control flow management weaknesses (CWE-691) in Cisco IOS XR Software allow unauthenticated remote attacker
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availabili
Crafted IPv4 packets addressed to the router itself can drive the line card network processor on Cisco IOS XR into repea
Exploit-DB