Skip to content
Back to search

CVE-2009-2049

MEDIUM
5.4NVD

Summary

generated automatically from NVD data

Several Cisco IOS releases and IOS XE 2.3 and 2.4 contain a flaw in BGP handling when RFC4893 support is enabled. A remote attacker acting as an RFC4271 peer can send a malformed update that forces the device to reload, causing a denial of service. The issue is tracked as Bug ID CSCta33973 and carries a CVSS v2.0 score of 5.4 (MEDIUM), with high attack complexity and no authentication required.

NVD description

Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4, 12.0(32)SY8 through 12.0(32)SY9, 12.2(33)SXI1 through 12.2(33)SXI2, 12.2XNC before 12.2(33)XNC2, 12.2XND before 12.2(33)XND1, and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled, allows remote attackers to cause a denial of service (device reload) by using an RFC4271 peer to send a malformed update, aka Bug ID CSCta33973.

Share:

EPSS · FIRST.org

2.4%probability of exploitation in the next 30 days

Higher than 84% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

CVSS v2.0 Score

5.4
/ 10.0
MEDIUM
AV:N/AC:H/Au:N/C:N/I:N/A:C

Information

Published
30 juil. 2009
Updated
16 juin 2026
Status
Modified
Source
psirt@cisco.com

Affected products

cisco ios
Versions : 12.0\(32\)s12, 12.0\(32\)s13, 12.0\(32\)sy8, 12.0\(32\)sy9, 12.0\(33\)s3
cisco ios xeAll Cisco IOS XE CVEs →
Versions : 2.3, 2.3.1t, 2.4, 2.4.0

Weaknesses (CWE)

CWE-16

References (12)

Similar CVEs

Other vulnerabilities of type CWE-16

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring