CVE-2020-3118

What is Cisco IOS XR and CDP?

IOS XR is Cisco's carrier-grade operating system used on high-end service provider and enterprise routers. Cisco Discovery Protocol (CDP) is a Layer 2 protocol enabled by default on Cisco equipment that lets directly connected devices exchange information about each other — model, software version, capabilities — for network management and troubleshooting purposes. Because CDP is processed automatically from any device on the same network segment, without authentication, flaws in CDP parsing are a well-known avenue for compromising Cisco infrastructure from an adjacent position on the network.

Overview

CVE-2020-3118 is a format string vulnerability in how Cisco IOS XR Software parses certain fields within CDP messages. An unauthenticated attacker who can reach a vulnerable device over a shared network segment can send a specially crafted CDP packet that either crashes the device (denial of service) or, in the worst case, achieves remote code execution with administrative privileges — a critical outcome given CDP requires no credentials and is enabled by default on most Cisco gear.

Technical Details

The flaw (CWE-134, Use of Externally-Controlled Format String) arises because certain string fields within CDP messages are passed directly into a format-string function without proper validation. Format string vulnerabilities allow attacker-controlled data to be interpreted as format specifiers, which can be leveraged to read or write arbitrary memory locations, ultimately enabling code execution in the context of the vulnerable process — in this case, a privileged process on the router. This vulnerability was disclosed alongside several related CDP-parsing bugs affecting other Cisco product lines (including NX-OS and Cisco Small Business switches), reflecting a broader review of CDP-handling code across Cisco's product portfolio.

Discovery

Identified and reported through Cisco's internal security testing and vulnerability research process, disclosed as part of a coordinated set of CDP-related advisories covering multiple Cisco software platforms.

Exploitation Context

CISA's KEV catalog listing confirms this vulnerability has been exploited in the wild. Layer 2, adjacent-network vulnerabilities like this are particularly attractive to attackers who have already gained a foothold inside a target network (for example, via a compromised endpoint on the same VLAN) and are looking to pivot into network infrastructure itself — compromising a router grants visibility and control over a much larger swath of traffic than a single endpoint.

Remediation

1. Apply the Cisco-provided software update for IOS XR that addresses this vulnerability.
2. Where CDP is not operationally required, disable it globally or on a per-interface basis to eliminate the attack surface entirely.
3. Segment management and infrastructure VLANs from general user traffic to reduce the pool of adjacent attackers who could reach vulnerable devices.
4. Monitor for anomalous or malformed CDP traffic using network intrusion detection tooling.
5. Review device logs and configurations for signs of unexpected reloads or configuration changes predating the patch.