Cisco IOS XR Cisco Discovery Protocol (CDP) Remote Code Execution and Stack Overflow Vulnerability (CVE-2020-3118)
Executive & SecOps Summary
SECOPS ASSESSMENTCisco network devices running Cisco IOS XR Software with Cisco Discovery Protocol (CDP) enabled
An unauthenticated, adjacent attacker in the same Layer 2 broadcast domain can execute arbitrary code with administrative privileges or cause a denial of service (device reload)
Apply official Cisco software patches immediately, or disable CDP globally/on untrusted interfaces as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade to the latest Cisco IOS XR software release or apply the specific Software Maintenance Upgrade (SMU) provided by Cisco.
# Example of adding and activating an SMU patch in Cisco IOS XR Admin CLI
admin
install add source tftp://10.1.1.10/patches/ ncs5k-sysadmin-6.6.3.CSVxxxxx.rpm
install activate id 1
install commit2. Temporary Workaround & Hardening Configuration
If patching is not immediately feasible, disable CDP globally or on untrusted, external-facing interfaces to mitigate the risk.
# Disable CDP globally in configuration mode
configure terminal
no cdp run
commit
# Alternatively, disable CDP on a specific interface
interface GigabitEthernet0/0/0/0
no cdp
commit3. Log Audit & IoC Verification Commands
Verify the CDP status and inspect system logs for any abnormal process crashes or reloads related to the CDP daemon.
# Check if CDP is active and inspect neighbors
show cdp
show cdp neighbors
# Search system logs for CDP process (cdpd) crashes or core dumps
show logging | include 'cdp|crash|core'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the Cisco Discovery Protocol (CDP) implementation of Cisco IOS XR Software. It is caused by improper validation of string input from specific fields within incoming CDP messages. This lack of validation leads to a stack-based buffer overflow and potential format string vulnerabilities (CWE-787, CWE-134).
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must reside within the same Layer 2 broadcast domain as the target device. The attacker transmits a specially crafted, malicious CDP packet to the target. When the device processes the malformed packet, the input length validation failure triggers a stack overflow, allowing the attacker to overwrite memory, hijack the execution flow, and run arbitrary code with administrative privileges or crash the device.
3. Infrastructure & Business Impact
Cisco IOS XR is widely deployed in service provider backbones and large enterprise core networks. A successful exploit allows complete compromise of the core routing infrastructure, enabling traffic interception, unauthorized access, or severe network-wide outages (Denial of Service). This vulnerability is actively tracked in the CISA KEV catalog, indicating real-world exploitation history.
Official Vendor Advisories & References
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
Frequently Asked SecOps Questions (CVE-2020-3118)
FAQQ1. How critical is CVE-2020-3118 and is it actively exploited in the wild?
CVE-2020-3118 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 11.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-3118?
Primary impacted vendors include cisco across ios xr. Scope summary: All Cisco routers and network devices running Cisco IOS XR Software with Cisco Discovery Protocol (CDP) enabled globally or per interface
Q3. What temporary mitigations or workarounds exist for CVE-2020-3118 before patching?
[Mitigation] Apply official Cisco software patches immediately, or disable CDP globally/on untrusted interfaces as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-3118
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cisco)
View Category →Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Cisco Secure Firewall Management Center (FMC) Insecure Deserialization Vulnerability (CVE-2026-20131, CVSS 10.0) - Remote Code Execution and Root Privilege Escalation
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.