What is DVMRP on Cisco IOS XR?
Distance Vector Multicast Routing Protocol (DVMRP) is used by carrier-grade routers running Cisco IOS XR to route multicast traffic across service provider networks. CVE-2020-3566 and CVE-2020-3569 (also enriched on this site) describe the same underlying vulnerability, tracked under two CVE identifiers and disclosed together in the same Cisco advisory.
Overview
CVE-2020-3566 is a denial-of-service vulnerability (CWE-400, uncontrolled resource consumption) in IOS XR's handling of crafted Internet Group Management Protocol (IGMP) packets used in DVMRP processing. An unauthenticated remote attacker can send crafted IGMP traffic that either immediately crashes the device's IGMP process or causes it to progressively exhaust available memory until it crashes (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 8.6 High). Cisco published this alongside CVE-2020-3569 in August 2020, issuing mitigation guidance while active exploitation attempts against internet-facing devices were already occurring — ahead of a full permanent software fix.
Technical Details
See CVE-2020-3569 for the shared technical root cause: insufficient validation of IGMP packet fields in DVMRP route processing allows a crafted packet to trigger unbounded memory consumption, exhausting device memory and causing a crash — a straightforward but effective denial-of-service primitive against carrier-grade routing infrastructure.
Discovery
Identified and reported by Cisco Talos, published alongside the companion CVE-2020-3569 advisory.
Exploitation Context
As with its companion CVE, Cisco confirmed observing active exploitation attempts against internet-facing IOS XR devices around the time of the August 2020 disclosure, driving the decision to publish mitigation guidance immediately rather than wait for a complete software fix.
Remediation
- Apply Cisco's software fix for IOS XR once available, and implement the interim mitigation guidance (rate-limiting DVMRP/IGMP traffic) from Cisco's advisory in the meantime.
- Restrict DVMRP/multicast traffic acceptance to trusted, expected peer routers only.
- Monitor device memory utilization for anomalous growth patterns on any IOS XR router running DVMRP.
- Treat this and CVE-2020-3569 as a single remediation item — apply the same fix and mitigations for both.
Key Details
| Property | Value |
|---|---|
| CVE ID | CVE-2020-3566 |
| Vendor / Product | Cisco — IOS XR |
| NVD Published | 2020-08-29 |
| NVD Last Modified | 2025-10-28 |
| CVSS 3.1 Score | 8.6 |
| CVSS 3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| Severity | HIGH |
| CWE | CWE-400 find similar ↗ |
| CISA KEV Added | 2021-11-03 |
| CISA KEV Deadline | 2022-05-03 |
| Known Ransomware Use | No |
CVSS 3.1 Breakdown
Required Action
Timeline
| Date | Event |
|---|---|
| 2020-08-29 | Cisco publishes a joint security advisory with mitigation guidance covering this and CVE-2020-3569, confirming active exploitation attempts |
| 2021-11-03 | Added to CISA Known Exploited Vulnerabilities catalog |
| 2022-05-03 | CISA BOD 22-01 remediation deadline |
References
| Resource | Type |
|---|---|
| Cisco Security Advisory — IOS XR Software DVMRP Memory Exhaustion Vulnerability | Vendor Advisory |
| Cisco Talos — Vulnerability Spotlight: IOS XR DVMRP | Security Research |
| NVD — CVE-2020-3566 | Vulnerability Database |
| CISA KEV Catalog Entry | US Government |