OTPulse

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability

MonitorCVSS 7.5cisco-sa-asr9k-tUyxcyXNOct 21, 2026
CiscoTransportation
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in Cisco IOS XR Software for ASR 9000 and 9900 Series routers and ASR 9902/9903 Compact High-Performance Routers allows an unauthenticated remote attacker to cause denial of service by sending crafted IPv4 packets destined for the router itself. The packets trigger incorrect handling in the IPv4 packet-processing path, causing network processor errors that reset the affected line card. The reset causes immediate traffic loss on that line card; repeated resets can force the network processor into a persistent shutdown state requiring manual line card reload. Transit IPv4 traffic and IPv6 traffic do not trigger this issue.

What this means
What could happen
An attacker can send specially crafted IPv4 packets to crash the network processor on line cards, causing temporary traffic loss or requiring manual line card restart to restore operations. Repeated attacks could force the network processor into a permanent shutdown state.
Who's at risk
This affects operators of Cisco ASR 9000, 9900, 9902, and 9903 Series Aggregation Services and Compact High-Performance Routers, particularly those in transportation networks and large service provider environments where these routers handle core or edge IP traffic. The issue impacts service continuity and requires attention from network operations teams.
How it could be exploited
An attacker sends crafted IPv4 packets destined for the router itself (for-us traffic) to an affected line card interface. The router's IPv4 packet processing function incorrectly handles these packets, triggering a network processor error that resets the line card. No authentication is required; the attacker only needs network connectivity to send packets to the router.
Prerequisites
  • Network connectivity to send IPv4 packets to an affected ASR 9000/9900/9902/9903 router
  • IPv4 packets must be addressed to the router itself (for-us traffic)
  • Router running vulnerable IOS XR software version 24.1.1 through 7.9.21
remotely exploitableno authentication requiredlow complexitydenial of servicehigh CVSS score (7.5)affects network infrastructure availability
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets24.1.1 through 7.9.21Fix available
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDIf an immediate update is not possible, restrict network access to the router's management and line card interfaces to only trusted sources using firewall rules or access control lists
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Cisco IOS XR Software for ASR 9000/9900/9902/9903 Series Routers to version 7.9.22 or later
Long-term hardening
0/1
HARDENINGImplement network segmentation to limit which devices can send traffic to the router
View full vendor advisory
API: /api/v1/advisories/a56fbd15-59c6-4617-939f-12018cc174e8

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.