Denial of Service Vulnerability in Cisco IOS XE Software's IKEv1 Implementation

CVE-2025-20192

Summary

A vulnerability exists in the Internet Key Exchange version 1 (IKEv1) implementation of Cisco IOS XE Software, which could be exploited by an authenticated, remote attacker to induce a denial of service (DoS) condition. This issue is attributed to improper validation of IKEv1 phase 2 parameters before the IPsec security association creation request is forwarded to the hardware cryptographic accelerator. An attacker with valid IKEv1 VPN credentials may exploit this vulnerability by sending specially crafted IKEv1 messages, potentially resulting in the affected device reloading and disrupting services.

References