CVE-2020-3118: Cisco IOS XR CDP packet parsing flaw allows adjacent code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with adjacent unauthenticated code execution and confirmed exploitation in CISA KEV, though it requires Layer 2 adjacency.

What it is

Cisco IOS XR's Cisco Discovery Protocol implementation fails to properly validate string input in certain CDP message fields, allowing a stack overflow. An unauthenticated attacker on the same Layer 2 broadcast domain can send a crafted CDP packet to execute code or reload the device.

Impact

A successful exploit can run arbitrary code with administrative privileges on the affected device or force a reload, giving the attacker full control of the router or causing a denial of service.

Attack surface

Reached over Layer 2 via crafted Cisco Discovery Protocol packets; the attacker must be in the same broadcast domain as the target. No authentication or user interaction is required (CVSS vector AV:A/PR:N/UI:N).

Exploitation

CVE-2020-3118 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and EPSS shows a 30-day probability of about 11.7% (95.8th percentile). No public exploit code or ransomware use is documented in this record.

What to do

• Apply the Cisco IOS XR software updates referenced in the vendor advisory cisco-sa-20200205-iosxr-cdp-rce.
• If CDP is not required, disable it on affected interfaces to remove the attack path.
• Restrict Layer 2 adjacency on access ports and use port security or similar controls to limit who can send CDP frames.
• Segment management and user networks so untrusted hosts are not in the same broadcast domain as IOS XR devices.
• Track CISA KEV remediation due date (2022-05-03) and verify patched status across the fleet.

Detection

• Monitor for unexpected or malformed CDP frames on interfaces facing untrusted segments.
• Alert on device reloads or crashes on IOS XR devices with no planned maintenance cause.
• Review IOS XR logs and crashinfo for stack overflow or CDP parsing faults.
• Baseline CDP neighbor tables and flag new or spoofed CDP advertisements from unexpected sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.