Cisco IOS XR vulnerabilities
11 known CVE vulnerabilities in Cisco IOS XR, translated and rated.
- CVE-2016-6428High
Cisco IOS XR version 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges.
- CVE-2016-1456High
The CLI in Cisco IOS XR versions 6.x through 6.0.1 allows local users to execute arbitrary OS commands in a privileged context by leveraging unspecified container access.
- CVE-2016-1407High
Cisco IOS XR versions up to 5.3.2 mishandle Local Packet Transport Services (LPTS) flow-based entries, allowing remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports.
- CVE-2015-6432High
Cisco IOS XR versions 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.2.2, 5.2.4, 5.3.0, and 5.3.2 do not properly restrict the number of Path Computation Elements (PCEs) for OSPF LSA opaque area updates, allowing remote attackers to cause a denial of service (device reload) via a crafted update.
- CVE-2015-0618High
Cisco IOS XR versions 5.0.1 and 5.2.1 on Network Convergence System 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X devices allow remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers.
- CVE-2014-3353High
Cisco IOS XR 4.3(.2) and earlier, used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a denial of service by sending a malformed IPv6 packet.
- CVE-2026-20279Critical
A vulnerability in Cisco IOS XR Software relates to improper access control issues (CWE-284). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20274Critical
A vulnerability in Cisco IOS XR Software relates to improper resource control issues (CWE-664). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2022-20821MediumActively exploited
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
- CVE-2020-3118HighActively exploited
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. It is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. Sending a malicious CDP packet could cause a stack overflow, potentially allowing code execution with administrative privileges.
- CVE-2009-2055MediumActively exploited
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS