Vulnerability in TACACS+ Protocol Implementation in Cisco IOS and IOS XE Software

CVE-2025-20160

What is CVE-2025-20160?

A vulnerability exists in the TACACS+ protocol implementation within Cisco IOS and IOS XE Software, allowing potential unauthorized access to devices. This issue arises from improper validation of the TACACS+ shared secret configuration. An attacker exploiting this vulnerability could intercept unencrypted TACACS+ messages or impersonate the TACACS+ server, leading to the unauthorized viewing of sensitive data or successful authentication without proper credentials. Device administrators should be aware of this security concern and consider implementing best practices to secure their TACACS+ configurations.

References