CVE-2009-2055: Cisco IOS XR BGP invalid attribute causes session reset DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed in-the-wild demonstration and causes availability loss on core routing, though CVSS rates it medium and exploitation requires BGP reachability.

What it is

Cisco IOS XR 3.4.0 through 3.8.1 fails to properly validate a BGP UPDATE message attribute, allowing a remote peer to reset BGP sessions. Because BGP session resets disrupt routing, this can cause a denial of service on affected routers. The flaw was demonstrated in the wild on 17 August 2009.

Impact

An attacker can force BGP session resets on affected IOS XR routers, disrupting routing and causing a denial of service. No confidentiality or integrity impact is described; the effect is availability only.

Attack surface

Reached over the network via a crafted BGP UPDATE message sent to a router running an affected IOS XR version. The CVSS vector shows no privileges and no user interaction required, though attack complexity is rated high, consistent with needing a BGP peering relationship or the ability to inject BGP traffic.

Exploitation

CVE-2009-2055 is listed in CISA KEV with a due date of 2022-04-15, and the description states it was demonstrated in the wild in 2009. EPSS 30-day probability is about 3.3 percent (87.9th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Cisco vendor advisory updates for IOS XR 3.4.0 through 3.8.1 as the primary fix.
• Restrict BGP peering to trusted, authenticated neighbors and apply prefix and attribute filtering where feasible.
• Monitor BGP session stability and alert on repeated resets from the same peer.
• If patching cannot be done immediately, isolate or rate-limit untrusted BGP sources per network design.

Detection

• Alert on repeated BGP session resets or flaps on IOS XR routers, especially correlated with a single peer.
• Log and review BGP UPDATE messages containing malformed or unexpected attributes.
• Track IOS XR version inventory to identify devices still running 3.4.0 through 3.8.1.
• Correlate router syslog and BGP neighbor state change events with known peer addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.