Bypass Vulnerability in Cisco IOS XR Software's Hybrid ACL Processing
CVE-2025-20144

4MEDIUM

Key Information:

Vendor
Cisco
Status
Cisco iOS Xr Software
Vendor
CVE Published:
12 March 2025

Badges

👾 Exploit Exists

Summary

A vulnerability exists in the hybrid access control list (ACL) processing of IPv4 packets within Cisco IOS XR Software. This issue allows an unauthenticated, remote attacker the potential to bypass existing ACL configurations due to incorrect packet handling when a specific ACL setup is in place. Exploiting this vulnerability enables unauthorized traffic to traverse an affected device, which can compromise network security. Cisco has issued software updates to remediate this issue and also provides workarounds for affected customers.

Affected Version(s)

Cisco IOS XR Software 6.5.3

Cisco IOS XR Software 6.5.2

Cisco IOS XR Software 6.5.92

References

https://sec.cloudapps.cisco.com/security/center/content/C...
https://blog.apnic.net/2024/09/02/crafting-endless-as-pat...

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.