Cisco Ios Xr Software
Monthly
Crafted IPv4 packets addressed to the router itself can drive the line card network processor on Cisco IOS XR into repeated resets, causing traffic loss and - under sustained attack - a persistent shutdown state that requires manual line card reload to recover. The flaw affects carrier-grade hardware specifically: Cisco ASR 9000 and 9900 Series Aggregation Services Routers plus the ASR 9902 and 9903 Compact High-Performance Routers. No authentication or user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is bounded by the fact that transit IPv4 traffic and all IPv6 traffic cannot trigger the fault.
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privileges to achieve full confidentiality, integrity, and availability impact against affected devices. The vulnerabilities were identified internally by Cisco's security engineering team and addressed in a batch hardening release, reference advisory cisco-sa-hardening-iosxr-qg64NcM. No public exploit code has been identified at time of analysis, though the CVSS 8.8 score and complete C/I/A triad reflect significant potential impact in carrier and enterprise routing infrastructure.
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker with low-privilege credentials to achieve high-impact compromise of confidentiality, integrity, and availability. The vulnerabilities were discovered internally by Cisco's security engineering team during a proactive review and are addressed in a software hardening release. No public exploit or active exploitation has been identified at time of analysis, but the CVSS 8.8 score and full C:H/I:H/A:H impact profile make this a significant risk for service-provider and enterprise core-network operators running affected IOS XR releases.
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail.
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacent network segment to achieve full confidentiality, integrity, and availability compromise of the affected device, as reflected by the CVSS 8.8 AV:A/PR:N/C:H/I:H/A:H vector. The vulnerabilities were discovered through an internal Cisco engineering security review and addressed in a software hardening release; no external exploitation has been reported. Given that IOS XR underpins carrier-grade routers and service-provider backbone infrastructure, successful exploitation could be highly disruptive to network operations.
Improper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening release stemming from Cisco's internal security review (advisory cisco-sa-hardening-iosxr-qg64NcM). The provided CVSS vector (AV:N/AC:L/PR:N/UI:N, 9.8) implies a remotely reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact on IOS XR routers, but Cisco's omnibus advisory publishes no technical specifics on the affected component or trigger. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied.
Insufficient control flow management weaknesses (CWE-691) in Cisco IOS XR Software allow unauthenticated remote attackers to cause a denial of service - service disruption leading to a device crash or reload - on affected routers and switch platforms. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) the issue is remotely reachable without authentication or user interaction, but there is no integrity or confidentiality impact, and the specific vulnerable feature or service is not named in the generic hardening advisory. Risk is currently moderate rather than critical: no public exploit has been identified at time of analysis, CISA SSVC records Exploitation as 'none' (Automatable: yes, Technical Impact: partial), and EPSS is only 0.25% (16th percentile), so near-term exploitation likelihood is low. Cisco addressed these internally discovered issues through scheduled IOS XR software hardening releases rather than in response to observed attacks.
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availability disruption and limited integrity impact against affected routers. Discovered through Cisco's own internal security audit, this CVE bundles multiple CWE-693 class weaknesses addressed in a coordinated hardening release. No active exploitation has been identified, but the combination of network-reachability, no authentication requirement, and an A:H CVSS impact score makes this a high-priority patch for service-provider and carrier-grade router deployments.
Crafted IPv4 packets addressed to the router itself can drive the line card network processor on Cisco IOS XR into repeated resets, causing traffic loss and - under sustained attack - a persistent shutdown state that requires manual line card reload to recover. The flaw affects carrier-grade hardware specifically: Cisco ASR 9000 and 9900 Series Aggregation Services Routers plus the ASR 9902 and 9903 Compact High-Performance Routers. No authentication or user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is bounded by the fact that transit IPv4 traffic and all IPv6 traffic cannot trigger the fault.
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privileges to achieve full confidentiality, integrity, and availability impact against affected devices. The vulnerabilities were identified internally by Cisco's security engineering team and addressed in a batch hardening release, reference advisory cisco-sa-hardening-iosxr-qg64NcM. No public exploit code has been identified at time of analysis, though the CVSS 8.8 score and complete C/I/A triad reflect significant potential impact in carrier and enterprise routing infrastructure.
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker with low-privilege credentials to achieve high-impact compromise of confidentiality, integrity, and availability. The vulnerabilities were discovered internally by Cisco's security engineering team during a proactive review and are addressed in a software hardening release. No public exploit or active exploitation has been identified at time of analysis, but the CVSS 8.8 score and full C:H/I:H/A:H impact profile make this a significant risk for service-provider and enterprise core-network operators running affected IOS XR releases.
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail.
Incorrect calculation vulnerabilities (CWE-682) in Cisco IOS XR Software allow an unauthenticated attacker on an adjacent network segment to achieve full confidentiality, integrity, and availability compromise of the affected device, as reflected by the CVSS 8.8 AV:A/PR:N/C:H/I:H/A:H vector. The vulnerabilities were discovered through an internal Cisco engineering security review and addressed in a software hardening release; no external exploitation has been reported. Given that IOS XR underpins carrier-grade routers and service-provider backbone infrastructure, successful exploitation could be highly disruptive to network operations.
Improper resource lifecycle control (CWE-664) in Cisco IOS XR Software is addressed by a batch software-hardening release stemming from Cisco's internal security review (advisory cisco-sa-hardening-iosxr-qg64NcM). The provided CVSS vector (AV:N/AC:L/PR:N/UI:N, 9.8) implies a remotely reachable, unauthenticated flaw with high confidentiality, integrity, and availability impact on IOS XR routers, but Cisco's omnibus advisory publishes no technical specifics on the affected component or trigger. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied.
Insufficient control flow management weaknesses (CWE-691) in Cisco IOS XR Software allow unauthenticated remote attackers to cause a denial of service - service disruption leading to a device crash or reload - on affected routers and switch platforms. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) the issue is remotely reachable without authentication or user interaction, but there is no integrity or confidentiality impact, and the specific vulnerable feature or service is not named in the generic hardening advisory. Risk is currently moderate rather than critical: no public exploit has been identified at time of analysis, CISA SSVC records Exploitation as 'none' (Automatable: yes, Technical Impact: partial), and EPSS is only 0.25% (16th percentile), so near-term exploitation likelihood is low. Cisco addressed these internally discovered issues through scheduled IOS XR software hardening releases rather than in response to observed attacks.
Protection mechanism failures in Cisco IOS XR Software allow remote unauthenticated attackers to achieve high availability disruption and limited integrity impact against affected routers. Discovered through Cisco's own internal security audit, this CVE bundles multiple CWE-693 class weaknesses addressed in a coordinated hardening release. No active exploitation has been identified, but the combination of network-reachability, no authentication requirement, and an A:H CVSS impact score makes this a high-priority patch for service-provider and carrier-grade router deployments.