CVE-2020-3118

Cisco IOS XR improperly validates CDP input, allowing adjacent attackers to execute admin code or reload devices.

Cisco IOS XR failed to validate string input from Cisco Discovery Protocol messages, enabling unauthenticated adjacent attackers to execute administrative code or reload the device. DIB orgs must care because this is a known, actively exploited vulnerability (KEV) that grants remote code execution and administrative control over network infrastructure, directly impacting compliance with NIST 800-171 controls on system integrity and access control. Organizations should immediately patch affected IOS XR versions and segment adjacent networks to mitigate exposure.

Shame score — A format string vulnerability in widely deployed network infrastructure that was actively exploited in the wild (KEV) allowing unauthenticated adjacent attackers to gain administrative control, representing a severe negligence in patching and input validation.