Bypass Vulnerability in Cisco IOS XR Software's Hybrid ACL Processing
CVE-2025-20144
4MEDIUM
Summary
A vulnerability exists in the hybrid access control list (ACL) processing of IPv4 packets within Cisco IOS XR Software. This issue allows an unauthenticated, remote attacker the potential to bypass existing ACL configurations due to incorrect packet handling when a specific ACL setup is in place. Exploiting this vulnerability enables unauthorized traffic to traverse an affected device, which can compromise network security. Cisco has issued software updates to remediate this issue and also provides workarounds for affected customers.
Affected Version(s)
Cisco IOS XR Software 6.5.3
Cisco IOS XR Software 6.5.2
Cisco IOS XR Software 6.5.92
References
CVSS V3.1
Score:
4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed
Timeline
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved