Cisco IOS XR Software Boot Process Vulnerability Allows Unverified Software Loading
CVE-2025-20177
Summary
A vulnerability exists in the boot process of Cisco IOS XR Software that allows an authenticated local attacker to evade Cisco's image signature verification mechanism, enabling unauthorized software to be loaded on the device. This issue stems from inadequate validation of files during the boot verification process. By manipulating system configuration options, an attacker with root-system privileges can bypass key integrity checks undertaken during booting. This breach could grant the attacker control over boot configurations and potentially allow them to run non-Cisco-signed images, undermining the overall security integrity of the system.
Affected Version(s)
Cisco IOS XR Software 7.0.1
Cisco IOS XR Software 7.0.0
Cisco IOS XR Software 7.1.1
References
CVSS V3.1
Timeline
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved