CVE-2025-20144

EUVD-2025-7290 · Published Mar 12, 2025

A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect handling of packets when a specific configuration of the hybrid ACL exists. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass a configured ACL on the affected device. For more information, see the section of this advisory. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

Technologies

Cisco Ncs 540-28Z4C-Sys-ACisco Ncs 5502Cisco Ncs 57C1-48Q6-SysCisco Ncs 57C3-Mod-SysCisco Ncs 540X-6Z18G-Sys-DCisco Ncs 540-Acc-SysCisco Ncs 5508Cisco Ncs 540-24Q8L2Dd-SysCisco Ncs 5501Cisco Ios XrCisco Ncs 5501-SeCisco Ncs 540X-16Z4G8Q2C-DCisco Ncs 540X-4Z14G2Q-DCisco Ncs 5516Cisco Ncs 540-6Z18G-Sys-DCisco Ncs 540X-4Z14G2Q-ACisco Ncs 540-24Z8Q2C-SysCisco Ncs 540-Fh-AggCisco Ncs 57B1-6D24-SysCisco Ncs 540X-8Z16G-Sys-DCisco Ncs 57D2-18Dd-SysCisco Ncs 540-24Q2C2Dd-SysCisco Ncs 540-6Z18G-Sys-ACisco Ncs 540X-12Z16G-Sys-ACisco Ncs 560-4Cisco Ncs 57B1-5Dse-SysCisco Ncs 540-12Z20G-Sys-ACisco Ncs 540X-16Z4G8Q2C-ACisco Ncs 5502-SeCisco Ncs 540X-6Z18G-Sys-ACisco Ncs 560-7Cisco Ncs 540-Fh-Csr-SysCisco Ncs 540-12Z20G-Sys-DCisco Ncs 540X-12Z16G-Sys-DCisco Ncs 540X-8Z16G-Sys-ACisco Ncs 540X-Acc-SysCisco Ncs 540-28Z4C-Sys-DCisco Ncs 540X-16Z8Q2C-DCisco Ncs 540-6Z14S-Sys-D

Weaknesses

CWE-284

CVSS scores

v3.15.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

Potentially impacted assets

See if this affects your attack surface