Main Vulnerability Database Vulnerabilities #VU105692

Improper access control in Cisco Systems, Inc products - CVE-2025-20144

Published: March 13, 2025

Vulnerability identifier: #VU105692

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-20144

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to incorrect handling of packets when a specific configuration of the hybrid access control list (ACL) exists. A remote attacker can bypass a configured ACL on the target device.

Affected software

Cisco IOS XR
IOS XR White box
NCS540
NCS560
NCS5500
NCS 5700 Series Routers

How to mitigate CVE-2025-20144

Install updates from vendor's website.

Cisco IOS XR - addressed in versions 6.2.1, 7.11.2, 7.11.21, 24.1.1, 24.1.2, 24.2.1, 24.2.2, 24.2.11, 24.2.20, 24.3.1, 24.3.2, 24.3.20, 24.4.1, 24.4.10

External References

Related Security Bulletins