Network Configuration Access Control Flaw in Cisco IOS XE Software

CVE-2025-20214

What is CVE-2025-20214?

A security flaw in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software enables an authenticated remote attacker to gain unauthorized read access to sensitive configuration or operational data. This issue arises from a change in the inner API call behavior, leading to incorrect filtering of results. Attackers can exploit this vulnerability via NETCONF, RESTCONF, or gRPC Network Management Interface (gNMI) protocols to query data on paths that should be blocked by the NACM configuration. Successful exploitation allows access to restricted data, especially if the attacker has obtained valid user credentials with lower privileges.

References