PatchSiren

PatchSiren cyber security CVE debrief

CVE-2010-3035 Cisco CVE debrief

CVE-2010-3035 is a Cisco IOS XR Border Gateway Protocol (BGP) denial-of-service vulnerability that CISA added to the Known Exploited Vulnerabilities (KEV) catalog on 2022-03-25. Because it is in KEV, it should be treated as a prioritized remediation item for any environment running affected Cisco IOS XR systems. CISA’s listed required action is to apply updates per vendor instructions.

Vendor
Cisco
Product
IOS XR
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-03-25
Original CVE updated
2022-03-25
Advisory published
2022-03-25
Advisory updated
2022-03-25

Who should care

Network security teams, Cisco IOS XR administrators, and operators responsible for edge routing infrastructure that uses BGP on Cisco IOS XR.

Technical summary

The available official record identifies this issue as a denial-of-service vulnerability affecting Cisco IOS XR and specifically references BGP. The source corpus does not provide further technical detail, exploit mechanics, or impact scope beyond the KEV listing and vendor/product identification.

Defensive priority

High. CISA inclusion in KEV indicates known exploitation and elevates remediation urgency. The KEV entry sets a due date of 2022-04-15 for applying updates per vendor instructions.

Recommended defensive actions

  • Inventory Cisco IOS XR deployments and confirm whether BGP is in use on exposed routing systems.
  • Review Cisco vendor guidance for the affected IOS XR release trains and apply the recommended updates.
  • Prioritize remediation for internet-facing or critical routing infrastructure first.
  • Validate that change windows, rollback plans, and configuration backups are in place before upgrading.
  • After remediation, confirm devices are on fixed software and monitor for BGP instability or unexpected service disruption.

Evidence notes

CISA KEV source item identifies the vulnerability as "Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability" and records vendorProject Cisco, product IOS XR, dateAdded 2022-03-25, dueDate 2022-04-15, and requiredAction "Apply updates per vendor instructions." The source item notes the related NVD record at https://nvd.nist.gov/vuln/detail/CVE-2010-3035. The provided official resource links include the CVE record, NVD detail page, and CISA KEV catalog.

Official resources

CVE published date supplied in the corpus is 2022-03-25 for the current record context, while the vulnerability itself is identified as CVE-2010-3035. This debrief uses the provided published/modified dates and KEV timeline fields only.