Denial of Service Vulnerability in Cisco ASR 903 Routers

CVE-2025-20189

What is CVE-2025-20189?

A vulnerability exists in the Cisco Express Forwarding functionality of Cisco IOS XE Software used in Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C). This issue arises from inadequate memory management during the processing of Address Resolution Protocol (ARP) messages, allowing an unauthenticated, adjacent attacker to cause a denial of service (DoS). By sending maliciously crafted ARP messages in rapid succession, an attacker can deplete system resources and trigger the reload of the active route switch processor (RSP), leading to potential service disruptions, especially if no redundant RSP is available.

References