This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Cisco IOS XR fixes 3 vulnerabilities

Cisco fixes 3 vulnerabilities in Cisco IOS XR with versions 25.1.2 and 25.2.1 [1][2][3]. For the vulnerability CVE-2025-20159, the specific vulnerable devices and the configuration changes required after the update are listed in [3].

Cisco IOS XR - DoS (CVE-2025-20340)
CVSS 7.4 (High)

An unauthenticated adjacent attacker can carry out a DoS attack by sending a large number of ARP packets to the management interface [1].

The vulnerability is present in product:

  • Cisco IOS XR; <=7.11; >=24.1, <24.2.21; >=24.3, <25.1.2; >=25.2, <25.2.1;

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 10. 9. 2025.

Cisco IOS XR - signature verification bypass (CVE-2025-20248)
CVSS 6.0 (Medium)

An authenticated local attacker with "root-system" privileges can bypass the signature check of an ".iso" file [2].

The vulnerability is present in product:

  • Cisco IOS XR; <=7.11; >=24.2, <24.2.21; >24.3, <24.4.2;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 10. 9. 2025.

Cisco IOS XR - ACL bypass (CVE-2025-20159)
CVSS 5.3 (Medium)

An unauthenticated remote attacker can bypass ACL restrictions applied to the management interface in the SSH, NetConf and gRPC functionality [3].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 10. 9. 2025.

By CESNET, z.s.p.o. Martin Krajči on 12. 9. 2025.

CESNET, z.s.p.o. Logo