Denial of Service Vulnerability in Cisco IOS XR Software
CVE-2025-20115
Key Information:
- Vendor
- Cisco
- Status
- Vendor
- CVE Published:
- 12 March 2025
Badges
Summary
A flaw in the handling of the Border Gateway Protocol (BGP) confederation implementation in Cisco IOS XR Software can lead to a denial of service condition. This vulnerability is triggered by memory corruption resulting from an AS_CONFED_SEQUENCE attribute that exceeds 255 autonomous system numbers. An unauthenticated remote attacker can exploit this condition by sending a specially crafted BGP update message, or through a network configuration that allows the AS_CONFED_SEQUENCE attribute to reach an excessive length. The exploitation can cause the BGP process to restart unexpectedly, disrupting network services. Control of a BGP confederation speaker within the same autonomous system is necessary for an attacker to carry out this exploit.
Affected Version(s)
Cisco IOS XR Software 6.5.3
Cisco IOS XR Software 6.5.29
Cisco IOS XR Software 6.5.1
Get notified when SecurityVulnerability.io launches alerting 🔔
Well keep you posted 📧
News Articles
Cisco IOS XR vulnerability lets attackers crash BGP on routers
Cisco has patched a denial of service (DoS) vulnerability that lets attackers crash the Border Gateway Protocol (BGP) process on IOS XR routers with a single BGP update message.
3 days ago
References
CVSS V3.1
Timeline
- 📰
First article discovered by BleepingComputer
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved