Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers ARP Denial of Service Vulnerability

TL;DR 📌

A high-severity vulnerability has been identified in Cisco IOS XE Software for ASR 903 Aggregation Services Routers, allowing unauthenticated adjacent attackers to trigger a denial of service (DoS) condition. Cisco has released software updates to address this issue, but there are no workarounds available.

What happened 🕵️‍♂️

A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated adjacent attacker to exploit the system. This vulnerability arises from improper memory management when processing Address Resolution Protocol (ARP) messages. By sending crafted ARP messages at a high rate, an attacker could exhaust system resources, leading to a reload of the active route switch processor (RSP). If there is no redundant RSP, the router will reload.

Affected products 🖥️

This vulnerability affects Cisco ASR 903 Aggregation Services Routers with RSP3C running vulnerable releases of Cisco IOS XE Software, regardless of device configuration. Products confirmed not vulnerable include IOS Software, IOS XE Software on devices other than ASR 903, IOS XR Software, Meraki products, and NX-OS Software.

Fixed software 🔧

Upgrade to at least the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that directly address this vulnerability. However, customers can monitor the RSS memory usage of the uea_mgr process to avoid unexpected reloads. If memory usage approaches critical levels, a planned reload of the RSP can be scheduled. Customers should evaluate the applicability of this mitigation in their own environments.

Risk in context 🎯

With a CVSS score of 7.4, this vulnerability is classified as high severity. The risk is significant as it allows for denial of service attacks that can disrupt network operations. Organizations using affected devices should prioritize applying the necessary software updates to mitigate this risk.

Fast facts ⚡

• Vulnerability: ARP Denial of Service
• CVSS Score: 7.4 (High)
• Affected Product: Cisco ASR 903 Aggregation Services Routers with RSP3C
• Exploit Type: Unauthenticated, adjacent attacker
• Impact: Denial of service leading to router reload

For leadership 🧭

It is crucial for organizations to address this vulnerability promptly to ensure the integrity and availability of their network infrastructure. Leadership should ensure that affected devices are updated with the latest software releases and that monitoring practices are in place to detect potential exploitation attempts. Regular reviews of security advisories and proactive management of network resources will help mitigate risks associated with this and future vulnerabilities.