This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes multiple vulnerabilities in its products
Cisco fixes several vulnerabilities in its Cisco IOS, IOS XE and IOS XR Software products. The most severe are described below; the remaining vulnerabilities can be found at [1]. Vulnerable products and their fixed versions can be found in the link for each vulnerability.
Due to insufficient validation of user arguments in the Cisco IOS XR Software CLI, an authenticated local attacker can escalate their privileges to root and execute arbitrary commands [2].
The vulnerability is present in product:
- *:Cisco IOS XR; <=24.1; >=24.2.0, <24.2.21; =24.3
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-20138 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
An unauthenticated remote attacker can reset a line card in Cisco IOS XR Software for Cisco ASR 9000, ASR 9902 and ASR 9903 routers, thereby causing a denial of service [3].
The vulnerability is present in product:
- *:Cisco IOS XR Software; <=7.8; >=7.9, <7.9.21; >=7.10; <7.10.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-20142 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
An unauthenticated remote attacker can reset a line card in Cisco IOS XR Software for Cisco ASR 9000, ASR 9902 and ASR 9903 routers, thereby causing a denial of service [4].
The vulnerability is present in product:
- *:Cisco IOS XR; <24.2.21
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-20146 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
Due to multiple vulnerabilities in the SNMP subsystem of Cisco IOS, Cisco IOS XE and Cisco IOS XR Software, an authenticated remote attacker can cause a denial of service [5].
The vulnerability is present in products:
- *:Cisco IOS Software; >=15.2E, <15.2(7)E12; >=15.5SY, <15.5(1)SY15; >=15.9M, <15.9(3)M11
- *:Cisco IOS XE Software; >=3.11E, <3.11.12E; >=16.12, <16.12.13; >=17.9, <17.9.7; >=17.12, <17.12.5; >=17.15, <17.15.3
- *:Cisco IOS XR Software; <=24.2, >=24.2, <24.2.21; >=24.3, <24.4.2; >=24.4, <24.4.2; >=25.2; <25.2.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-20169 at cve.org, NVD
- CVE-2025-20170 at cve.org, NVD
- CVE-2025-20171 at cve.org, NVD
- CVE-2025-20172 at cve.org, NVD
- CVE-2025-20173 at cve.org, NVD
- CVE-2025-20174 at cve.org, NVD
- CVE-2025-20175 at cve.org, NVD
- CVE-2025-20176 at cve.org, NVD
- CWE-805: Buffer Access with Incorrect Length Value at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
An authenticated local attacker with high privileges can bypass the Secure Boot function and load unverified software on a device running Cisco IOS XR Software [6].
The vulnerability is present in product:
- *:Cisco IOS XR Software; <=7.8; >=7.9, <7.9.1
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-20143 at cve.org, NVD
- CWE-347: Improper Verification of Cryptographic Signature at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
An authenticated local attacker with root-system privileges can bypass Cisco IOS XR image signature verification and load unverified software on the affected device [7].
The vulnerability is present in product:
- *:Cisco IOS XR Software; <=7.10; >=7.11, <7.11.21; >=24.2, <24.2.2; >=24.3, <24.3.2, >=24.4, <24.4.1
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-20177 at cve.org, NVD
- CWE-274: Improper Handling of Insufficient Privileges at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
Due to memory corruption in the implementation of Border Gateway Protocol (BGP) confederations in Cisco IOS XR Software, an unauthenticated remote attacker can cause a denial of service [8].
The vulnerability is present in product:
- *:Cisco IOS XR Software; <=7.11; <=24.1; >=24.2, <24.2.21; >=24.3, <24.3.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-20115 at cve.org, NVD
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
Due to a vulnerability in the Internet Key Exchange version 2 (IKEv2) function in Cisco IOS XR Software, an unauthenticated remote attacker can prevent the affected device from processing any control plane UDP packets [9].
The vulnerability is present in product:
- *:Cisco IOS XR; <=7.10; >=7.11, <7.11.21; >=24.1, <24.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-20209 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
Due to a vulnerability in the processing of specific packets in Cisco IOS XR Software, an unauthenticated attacker on the local network can halt control plane traffic on multiple platforms [10].
The vulnerability is present in product:
- *:Cisco IOS XR Software; =7.9.2
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-20141 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/publicationListing.x
- [2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-GFQjxvOF
- [3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv4uni-LfM3cfBu
- [4] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multicast-ERMrSvq7
- [5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-dos-sdxnSUcW
- [6] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-lkm-zNErZjbZ
- [7] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xr-verii-bypass-HhPwQRvx
- [8] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bgp-dos-O7stePhX
- [9] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrike-9wYGpRGq
- [10] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr792-bWfVDPY
By CESNET, z.s.p.o. Michaela Jarošová on 17. 3. 2025.