# CVE-2009-2055

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

- Page: https://www.vulneraibility.com/cve/CVE-2009-2055
- CVSS: 5.9
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15
- EPSS: 3.31% (percentile 88.7)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2024-11-08)
- Weakness: CWE-20
- Published: 2009-08-19

## Affected

- cisco:ios_xr

## References

- [other] http://mailman.nanog.org/pipermail/nanog/2009-August/012719.html
- [other] http://securitytracker.com/id?1022739
- [advisory] http://www.cisco.com/en/US/products/products_security_advisory09186a0080af150f.shtml
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-2055

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.