EUVD-2026-70205
GHSA-jp29-xjv5-g87x
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent attack vector and no-auth (PR:N) are consistent with control-plane/protocol processing reachable from peering or local-segment hosts; full C:H/I:H/A:H reflects complete device compromise potential from arithmetic corruption.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
4DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20275 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-682.
AnalysisAI
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacent network segment to achieve full confidentiality, integrity, and availability compromise of the affected device, as reflected by the CVSS 8.8 AV:A/PR:N/C:H/I:H/A:H vector. The vulnerabilities were discovered through an internal Cisco engineering security review and addressed in a software hardening release; no external exploitation has been reported. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Adjacent network access is required (AV:A) - the attacker must be able to send traffic directly to the target device on the same network segment or via a direct peering relationship; remote internet-based exploitation is not possible without lateral movement to an adjacent position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.8 with AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a serious but adjacency-constrained risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade Cisco IOS XR Software to a fixed release identified in Cisco Security Advisory cisco-sa-hardening-iosxr-qg64NcM (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Cisco IOS XR devices in your environment using inventory and discovery tools, document affected software versions, and flag any deployments in network-critical roles (backbone routers, core infrastructure). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xr Software
View allImproper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening releas
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restric
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privile
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker
Remote unauthenticated denial-of-service conditions in Cisco IOS XR Software stem from multiple insufficient control flo
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availabili
Same weakness CWE-682 – Incorrect Calculation
View allShare
External POC / Exploit Code
Leaving vuln.today