Access Control Vulnerability in Cisco Switches

CVE-2025-20137

Summary

A flaw in the access control list (ACL) programming of Cisco IOS Software could enable an unauthenticated remote attacker to bypass configured ACLs on Cisco Catalyst 1000 and 2960L Switches. This vulnerability arises from the misuse of both an IPv4 ACL and a dynamic ACL of IP Source Guard on the same interface, which is considered an unsupported configuration. Attackers could exploit this issue by sending malicious traffic through the affected devices, potentially gaining unauthorized access. Although Cisco has updated its documentation to indicate that this configuration is unsupported, there are currently no measures to restrict administrators from applying both features to the same interface.

References