Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C N N H 8.6 .0370 89.4 YES
AFFECTED Product Versions Fixed Cisco IOS XR Software n/a – —
TIMELINE Dec 12 Reserved by cisco Aug 29 Published (CNA: cisco) Nov 3 Added to CISA KEV, remediation due 2022-05-03
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.
| Date | Event | Detail |
|---|---|---|
| December 12, 2019 | Reserved | Reserved by cisco |
| August 29, 2020 | Published | Published (CNA: cisco) |
| November 3, 2021 | KEV ADDED | Added to CISA KEV, remediation due 2022-05-03 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Cisco | Cisco IOS XR Software | — | n/a | — |
Authoritative record: CVE-2020-3566 at cve.org
Vendors: cisco
Weaknesses: CWE-400
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2020-3566 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
