Security readout for executives and security teams
Plain-English summary
This flaw affects Cisco IOS XR routers using BGP Additional Paths. A malicious BGP peer update can trigger a condition where viewing BGP status causes BGP updates to stop processing, leaving routing data stale. Business impact is availability-focused, not data theft.
Executive priority
Treat as a targeted infrastructure availability risk. It is not a broad internet worm scenario, but routing control-plane disruption on critical IOS XR devices can affect service reliability and incident response visibility.
Technical view
Cisco IOS XR incorrectly calculates lexicographical order when displaying BGP Additional Paths information, creating an infinite loop. Exploitation requires a crafted BGP update from a neighbor peer and a legitimate user displaying BGP status. Successful exploitation blocks monitoring and prevents new BGP updates from being processed.
Likely exposure
Exposure is most likely on Cisco IOS XR devices running BGP with Additional Paths enabled. The source bundle does not identify affected or fixed version numbers, so teams must map inventory against Cisco guidance.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not claim active exploitation. Exploitation is constrained by BGP neighbor context and requires an authorized user action, but affected routers may be business-critical.
Researcher notes
Key constraints are important: the attacker must operate through a BGP neighbor peer session, and exploitation is triggered when an authorized user views BGP status. Version and patch specifics are not present in the bundle.
Mitigation direction
- Check the Cisco advisory for affected and fixed IOS XR releases.
- Prioritize upgrades or vendor-recommended remediation for exposed routing infrastructure.
- Review BGP neighbor relationships and remove unauthorized or unused peers.
- Increase monitoring for stale routing tables or stopped BGP update processing.
Validation and detection
- Inventory Cisco IOS XR routers running BGP Additional Paths.
- Compare device versions and configurations with Cisco advisory guidance.
- Confirm BGP neighbor sessions are expected, trusted, and documented.
- Review operational logs for BGP monitoring failures or update processing stalls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-754: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-3449 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- 20200805 Cisco IOS XR Software Additional Paths Denial of Service VulnerabilityCVE reference · vendor-advisory, x_refsource_CISCO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Check for Unusual or Exceptional Conditions
Improper Check for Unusual or Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.