CVE-2025-20159

Summary

A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features.

This vulnerability exists because management interface ACLs have not been supported on Cisco IOS XR Software Packet I/O infrastructure platforms for Linux-handled features such as SSH, NetConf, or gRPC. An attacker could exploit this vulnerability by attempting to send traffic to an affected device. A successful exploit could allow the attacker to bypass an ingress ACL that is applied on the management interface of the affected device.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco IOS XR Software6.6.1affected
CiscoCisco IOS XR Software6.5.3affected
CiscoCisco IOS XR Software7.0.1affected
CiscoCisco IOS XR Software6.6.11affected
CiscoCisco IOS XR Software6.5.1affected
CiscoCisco IOS XR Software6.5.2affected
CiscoCisco IOS XR Software6.6.2affected
CiscoCisco IOS XR Software6.6.12affected
CiscoCisco IOS XR Software6.6.25affected
CiscoCisco IOS XR Software7.1.1affected
CiscoCisco IOS XR Software7.0.90affected
CiscoCisco IOS XR Software6.6.3affected
CiscoCisco IOS XR Software7.0.2affected
CiscoCisco IOS XR Software7.1.2affected
CiscoCisco IOS XR Software7.2.1affected
CiscoCisco IOS XR Software7.0.11affected
CiscoCisco IOS XR Software7.0.12affected
CiscoCisco IOS XR Software7.0.14affected
CiscoCisco IOS XR Software6.6.4affected
CiscoCisco IOS XR Software7.2.12affected
CiscoCisco IOS XR Software7.3.1affected
CiscoCisco IOS XR Software7.4.1affected
CiscoCisco IOS XR Software7.2.2affected
CiscoCisco IOS XR Software7.3.15affected
CiscoCisco IOS XR Software7.3.16affected
CiscoCisco IOS XR Software7.4.15affected
CiscoCisco IOS XR Software7.3.2affected
CiscoCisco IOS XR Software7.5.1affected
CiscoCisco IOS XR Software7.4.16affected
CiscoCisco IOS XR Software7.3.27affected
CiscoCisco IOS XR Software7.6.1affected
CiscoCisco IOS XR Software7.5.2affected
CiscoCisco IOS XR Software7.8.1affected
CiscoCisco IOS XR Software7.6.15affected
CiscoCisco IOS XR Software7.5.12affected
CiscoCisco IOS XR Software7.8.12affected
CiscoCisco IOS XR Software7.3.4affected
CiscoCisco IOS XR Software7.3.3affected
CiscoCisco IOS XR Software7.4.2affected
CiscoCisco IOS XR Software7.7.1affected
CiscoCisco IOS XR Software7.6.2affected
CiscoCisco IOS XR Software7.5.3affected
CiscoCisco IOS XR Software7.7.2affected
CiscoCisco IOS XR Software7.9.1affected
CiscoCisco IOS XR Software7.10.1affected
CiscoCisco IOS XR Software7.8.2affected
CiscoCisco IOS XR Software7.5.4affected
CiscoCisco IOS XR Software7.8.22affected
CiscoCisco IOS XR Software7.7.21affected
CiscoCisco IOS XR Software7.9.2affected
CiscoCisco IOS XR Software7.3.5affected
CiscoCisco IOS XR Software7.5.5affected
CiscoCisco IOS XR Software7.11.1affected
CiscoCisco IOS XR Software7.10.2affected
CiscoCisco IOS XR Software24.1.1affected
CiscoCisco IOS XR Software7.3.6affected
CiscoCisco IOS XR Software7.5.52affected
CiscoCisco IOS XR Software7.11.2affected
CiscoCisco IOS XR Software24.2.1affected
CiscoCisco IOS XR Software24.1.2affected
CiscoCisco IOS XR Software24.2.11affected
CiscoCisco IOS XR Software24.3.1affected
CiscoCisco IOS XR Software24.4.1affected
CiscoCisco IOS XR Software24.2.2affected
CiscoCisco IOS XR Software7.11.21affected
CiscoCisco IOS XR Software24.2.20affected
CiscoCisco IOS XR Software24.3.2affected
CiscoCisco IOS XR Software25.1.1affected
CiscoCisco IOS XR Software24.4.2affected
CiscoCisco IOS XR Software24.3.20affected
CiscoCisco IOS XR Software25.1.2affected
CiscoCisco IOS XR Software24.3.30affected
CiscoCisco IOS XR Software24.4.30affected
CiscoCisco IOS XR Software24.2.21affected

Weaknesses

  • CWE-284: Improper Access Control

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References