Cisco IOS XR Software Boot Process Vulnerability Allows Unverified Software Loading
CVE-2025-20177

6.7MEDIUM

Key Information:

Vendor
Cisco
Vendor
CVE Published:
12 March 2025

Badges

👾 Exploit Exists

Summary

A vulnerability exists in the boot process of Cisco IOS XR Software that allows an authenticated local attacker to evade Cisco's image signature verification mechanism, enabling unauthorized software to be loaded on the device. This issue stems from inadequate validation of files during the boot verification process. By manipulating system configuration options, an attacker with root-system privileges can bypass key integrity checks undertaken during booting. This breach could grant the attacker control over boot configurations and potentially allow them to run non-Cisco-signed images, undermining the overall security integrity of the system.

Affected Version(s)

Cisco IOS XR Software 7.0.1

Cisco IOS XR Software 7.0.0

Cisco IOS XR Software 7.1.1

References

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.