IX
Product
IOS XR
On CISA KEVExploited in the wild
200
CVEs
9
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 79Medium 54Low 0
Watch
Add IOS XR to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-20233 | 6.5 | Sep 13 | A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS)… Affected: before 7.5.4; 7.6 before 7.6.3; 7.7 before 7.7.21; 7.8 before 7.8.2; 7.9.0 |
| CVE-2021-1389 | 6.5 | Feb 4 | A vulnerability in the IPv6 traffic processing of Cisco IOS XR Software and Cisco NX-OS Software for certain Cisco devices could allow an unauthenticated, remote attacker to… Affected: before 6.6.3; 7.1.0; 7.2.0 |
| CVE-2021-1268 | 6.5 | Feb 4 | A vulnerability in the IPv6 protocol handling of the management interfaces of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause an IPv6 flood on the… Affected: before 6.7.3; 7.1.0 before 7.1.3; 7.2.0 before 7.2.2; 7.3.0 |
| CVE-2020-3120 | 6.5 | Feb 5 | A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent… Affected: 5.2.5; 6.4.2; 6.5.3; 6.6.25; 7.0.1 |
| CVE-2019-16027 | 6.5 | Jan 26 | A vulnerability in the implementation of the Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS XR Software could… Affected: 4.3.2; 5.2.5; 6.2.2; 6.2.3; 6.2.25; 6.3.3; +34 more |
| CVE-2019-16018 | 6.5 | Jan 26 | A vulnerability in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker… Affected: 6.6.1; 6.6.2; 6.6.25; 7.0.1 |
| CVE-2019-1849 | 6.5 | May 16 | A vulnerability in the Border Gateway Patrol (BGP) Multiprotocol Label Switching (MPLS)-based Ethernet VPN (EVPN) implementation of Cisco IOS XR Software could allow an… Affected: 6.1.0 before 6.3.3; 6.4.0 before 6.4.2; 6.5.0 before 6.5.2; 6.6.0 before 6.6.1 |
| CVE-2016-1366 | 6.5 | Mar 24 | The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows remote authenticated… Affected: 5.0.0; 5.0.1; 5.2.1; 5.2.3; 5.2.4; 5.2.5 |
| CVE-2021-34709 | 6.4 | Sep 9 | Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and… Affected: before 7.3.2; before 7.3.2; 7.4.0 before 7.4.1 |
| CVE-2022-20849 | 6.1 | Nov 15 | Cisco IOS XR Software Broadband Network Gateway PPPoE Denial of Service Vulnerability Affected: 6.5.1; 6.5.2; 6.5.3; 6.5.15; 6.6.1; 6.6.2; +27 more |
| CVE-2025-20248 | 6.0 | Sep 10 | Cisco IOS XR Software Image Verification Bypass Vulnerability Affected: 6.5.1; 6.5.2; 6.5.3; 6.5.15; 6.5.25; 6.5.26; +34 more |
| CVE-2017-6666 | 6.0 | Jun 13 | A vulnerability in the forwarding component of Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series Routers could allow an authenticated, local attacker to… Affected: 6.0.0; 6.0.1; 6.0_base; 6.1.0; 6.1.1; 6.1.2; +3 more |
| CVE-2019-1909 | 5.9 | Jul 6 | A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of… Affected: 4.3.1 before 6.6.2 |
| CVE-2025-20145 | 5.8 | Mar 12 | Cisco IOS XR Software Access Control List Bypass Vulnerability Affected: 6.5.1; 6.5.2; 6.5.3; 6.5.92; 6.5.93; 6.6.1; +34 more |
| CVE-2025-20144 | 5.8 | Mar 12 | Cisco IOS XR Software Access Control List Bypass Vulnerability Affected: 6.5.1; 6.5.2; 6.5.3; 6.5.92; 6.5.93; 6.6.1; +34 more |
| CVE-2024-20322 | 5.8 | Mar 13 | A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote… Affected: 7.10.2; 7.11 |
| CVE-2020-3190 | 5.8 | Mar 4 | A vulnerability in the IPsec packet processor of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition for IPsec… Affected: before 6.4.3; 6.6.0 before 6.6.3; 7.0.0 before 7.0.2; 7.1.0 before 7.1.1 |
| CVE-2024-20489 | 5.5 | Sep 11 | Cisco Routed Passive Optical Network Cleartext Password Vulnerability Affected: 24.1.1; 24.1.2; 24.2.1; 24.2.11; 24.3.1 |
| CVE-2024-20343 | 5.5 | Sep 11 | Cisco IOS XR Software CLI Arbitrary File Read Vulnerability Affected: 6.5.1; 6.5.2; 6.5.3; 6.5.15; 6.5.92; 6.5.93; +34 more |
| CVE-2021-34771 | 5.5 | Sep 9 | A vulnerability in the Cisco IOS XR Software CLI could allow an authenticated, local attacker to view more information than their privileges allow Affected: before 7.3.2 |
| CVE-2021-1128 | 5.5 | Feb 4 | A vulnerability in the CLI parser of Cisco IOS XR Software could allow an authenticated, local attacker to view more information than their privileges allow Affected: before 7.1.2; 7.2.0; 7.3.0 |
| CVE-2024-20390 | 5.3 | Sep 11 | Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service Vulnerability Affected: before 24.1.2 |
| CVE-2024-20266 | 5.3 | Mar 13 | A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process,… Affected: 5.2.0; 5.2.1; 5.2.2; 5.2.4; 5.2.3; 5.2.5; +34 more |
| CVE-2023-20190 | 5.3 | Sep 13 | A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that… Affected: before 7.3.5; 7.5 before 7.5.4; 7.6 before 7.8.2; 7.9 |
| CVE-2020-3364 | 5.3 | Jun 18 | A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote… Affected: 6.7.1; 7.0.2; 7.0.11; 7.0.12; 7.1.1; 7.1.15 |
| CVE-2019-15998 | 5.3 | Nov 26 | A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is… Affected: 6.5.1; 6.5.2; 6.5.3 |
| CVE-2018-0286 | 5.3 | May 2 | A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on affected system Affected: 6.3.1; 6.3.2; 6.5.1 |
| CVE-2017-12355 | 5.3 | Nov 30 | A vulnerability in the Local Packet Transport Services (LPTS) ingress frame-processing functionality of Cisco IOS XR Software could allow an unauthenticated, remote attacker to… Affected: 6.4.1_base |
| CVE-2017-6599 | 5.3 | Apr 7 | A vulnerability in Google-defined remote procedure call (gRPC) handling in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management… Affected: 6.1.1; 6.2.1 |
| CVE-2016-6421 | 5.3 | Oct 5 | Cisco IOS XR 5.2.2 allows remote attackers to cause a denial of service (process restart) via a crafted OSPF Link State Advertisement (LSA) update, aka Bug ID CSCvb05643 Affected: 5.2.2 |
| CVE-2016-1433 | 5.3 | Sep 18 | Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service (OSPFv3 process reload) via crafted OSPFv3 packets, aka Bug ID CSCuz66289 Affected: 6.0.0; 6.0.1; 6.0_base |
| CVE-2016-1376 | 5.3 | Apr 12 | Cisco IOS XR 4.2.3, 4.3.0, 4.3.4, and 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (CRC and symbol errors, and interface flap) via crafted bit… Affected: 4.2.3; 4.3.0; 4.3.4; 5.3.1 |
| CVE-2016-1361 | 5.3 | Mar 12 | Cisco IOS XR through 4.3.2 on Gigabit Switch Router (GSR) 12000 devices does not properly check for a Bidirectional Forwarding Detection (BFD) header in a UDP packet, which allows… Affected: 3.3.3; 3.4.1; 3.4.2; 3.4.3; 3.5.2; 3.5.3; +28 more |
| CVE-2023-20064 | 4.6 | Mar 9 | A vulnerability in the GRand Unified Bootloader (GRUB) for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files… Affected: before 7.9.1; before 7.6.1; before 7.7.1 |
| CVE-2022-20846 | 4.3 | Nov 15 | Cisco IOS XR Software Cisco Discovery Protocol Buffer Overflow Vulnerability Affected: 6.5.1; 6.5.2; 6.5.3; 6.5.15; 6.5.25; 6.5.26; +34 more |
| CVE-2024-20319 | 4.3 | Mar 13 | A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and… Affected: 5.2.0; 5.2.1; 5.2.2; 5.2.3; 5.2.4; 5.2.5; +34 more |
| CVE-2020-3449 | 4.3 | Aug 17 | A vulnerability in the Border Gateway Protocol (BGP) additional paths feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent authorized users… Affected: before 7.1.2; 7.2.0 before 7.2.1; 7.3.0 before 7.3.1 |
| CVE-2015-6301 | – | Sep 20 | The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID… Affected: 5.2.0_base |
| CVE-2015-6297 | – | Sep 18 | The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets, aka Bug ID… Affected: 5.2.0_base |
| CVE-2015-4285 | – | Jul 23 | The Local Packet Transport Services (LPTS) implementation in Cisco IOS XR 5.1.2, 5.1.3, 5.2.1, and 5.2.2 on ASR9k devices makes incorrect decisions about the opening of TCP and… Affected: 5.1.2; 5.1.3; 5.2.1; 5.2.2 |
| CVE-2015-4284 | – | Jul 22 | The Concurrent Data Management Replication process in Cisco IOS XR 5.3.0 on ASR 9000 devices allows remote attackers to cause a denial of service (BGP process reload) via… Affected: 5.3.0 |
| CVE-2015-4223 | – | Jun 25 | Cisco IOS XR 5.1.3 allows remote attackers to cause a denial of service (process reload) via crafted MPLS Label Distribution Protocol (LDP) packets, aka Bug ID CSCuu77478 Affected: 5.1.3 |
| CVE-2015-4205 | – | Jun 23 | Cisco IOS XR 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (NPU chip reset or line-card reload) by sending crafted IEEE 802.3x flow-control PAUSE… Affected: 5.3.1 |
| CVE-2015-4195 | – | Jun 19 | Cisco IOS XR 5.1.1.K9SEC allows remote authenticated users to cause a denial of service (vty error, and SSH and TELNET outage) via a crafted disconnect action within an SSH… Affected: 5.1.1.k9sec |
| CVE-2015-4191 | – | Jun 19 | Cisco IOS XR 5.2.1 allows remote attackers to cause a denial of service (ipv6_io service reload) via a malformed IPv6 packet, aka Bug ID CSCuq95565 Affected: 5.2.1 |
| CVE-2015-0776 | – | Jun 12 | telnetd in Cisco IOS XR 5.0.1 on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (device reload) via a malformed TELNET packet, aka… Affected: 5.0.1 |
| CVE-2015-0695 | – | Apr 17 | Cisco IOS XR 4.3.4 through 5.3.0 on ASR 9000 devices, when uRPF, PBR, QoS, or an ACL is configured, does not properly handle bridge-group virtual interface (BVI) traffic, which… Affected: 4.3.0; 4.3.1; 4.3.2; 4.3.3; 5.1.0; 5.1.1; +3 more |
| CVE-2015-0694 | – | Apr 11 | Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended… Affected: 5.3.0_base |
| CVE-2015-0672 | – | Mar 26 | The DHCPv4 server in Cisco IOS XR 5.2.2 on ASR 9000 devices allows remote attackers to cause a denial of service (service outage) via a flood of crafted DHCP packets, aka Bug ID… Affected: 5.2.2 |
| CVE-2015-0661 | – | Mar 6 | The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858 Affected: All versions, or not specified |