CVE-2025-20144

EPSS 0.05%
Published 12.03.2025 16:12:39
Last modified 04.08.2025 12:02:45
Source psirt@cisco.com
Teams watchlist Login
Open Login

A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.

This vulnerability is due to incorrect handling of packets when a specific configuration of the hybrid ACL exists. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass a configured ACL on the affected device.
For more information, see the  section of this advisory.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

This information is available to logged-in users.

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Ios Xr Version6.5.1

   Cisco ≫ Ncs 540-12z20g-sys-a Version-
   Cisco ≫ Ncs 540-12z20g-sys-d Version-
   Cisco ≫ Ncs 540-24q2c2dd-sys Version-
   Cisco ≫ Ncs 540-24q8l2dd-sys Version-
   Cisco ≫ Ncs 540-24z8q2c-sys Version-
   Cisco ≫ Ncs 540-28z4c-sys-a Version-
   Cisco ≫ Ncs 540-28z4c-sys-d Version-
   Cisco ≫ Ncs 540-6z14s-sys-d Version-
   Cisco ≫ Ncs 540-6z18g-sys-a Version-
   Cisco ≫ Ncs 540-6z18g-sys-d Version-
   Cisco ≫ Ncs 540-acc-sys Version-
   Cisco ≫ Ncs 540-fh-agg Version-
   Cisco ≫ Ncs 540-fh-csr-sys Version-
   Cisco ≫ Ncs 540x-12z16g-sys-a Version-
   Cisco ≫ Ncs 540x-12z16g-sys-d Version-
   Cisco ≫ Ncs 540x-16z4g8q2c-a Version-
   Cisco ≫ Ncs 540x-16z4g8q2c-d Version-
   Cisco ≫ Ncs 540x-16z8q2c-d Version-
   Cisco ≫ Ncs 540x-4z14g2q-a Version-
   Cisco ≫ Ncs 540x-4z14g2q-d Version-
   Cisco ≫ Ncs 540x-6z18g-sys-a Version-
   Cisco ≫ Ncs 540x-6z18g-sys-d Version-
   Cisco ≫ Ncs 540x-8z16g-sys-a Version-
   Cisco ≫ Ncs 540x-8z16g-sys-d Version-
   Cisco ≫ Ncs 540x-acc-sys Version-
   Cisco ≫ Ncs 5501 Version-
   Cisco ≫ Ncs 5501-se Version-
   Cisco ≫ Ncs 5502 Version-
   Cisco ≫ Ncs 5502-se Version-
   Cisco ≫ Ncs 5508 Version-
   Cisco ≫ Ncs 5516 Version-
   Cisco ≫ Ncs 560-4 Version-
   Cisco ≫ Ncs 560-7 Version-
   Cisco ≫ Ncs 57b1-5dse-sys Version-
   Cisco ≫ Ncs 57b1-6d24-sys Version-
   Cisco ≫ Ncs 57c1-48q6-sys Version-
   Cisco ≫ Ncs 57c3-mod-sys Version-
   Cisco ≫ Ncs 57d2-18dd-sys Version-

Cisco ≫ Ios Xr Version6.5.2

Cisco ≫ Ios Xr Version6.5.3

Cisco ≫ Ios Xr Version6.5.92

Cisco ≫ Ios Xr Version6.5.93

Cisco ≫ Ios Xr Version6.6.1

Cisco ≫ Ios Xr Version6.6.2

Cisco ≫ Ios Xr Version6.6.3

Cisco ≫ Ios Xr Version6.6.4

Cisco ≫ Ios Xr Version6.6.25

Cisco ≫ Ios Xr Version7.0.1

Cisco ≫ Ios Xr Version7.0.2

Cisco ≫ Ios Xr Version7.0.90

Cisco ≫ Ios Xr Version7.1.1

Cisco ≫ Ios Xr Version7.1.2

Cisco ≫ Ios Xr Version7.2.1

Cisco ≫ Ios Xr Version7.2.2

Cisco ≫ Ios Xr Version7.3.1

Cisco ≫ Ios Xr Version7.3.2

Cisco ≫ Ios Xr Version7.3.3

Cisco ≫ Ios Xr Version7.3.4

Cisco ≫ Ios Xr Version7.3.5

Cisco ≫ Ios Xr Version7.3.6

Cisco ≫ Ios Xr Version7.4.1

Cisco ≫ Ios Xr Version7.4.2

Cisco ≫ Ios Xr Version7.5.1

Cisco ≫ Ios Xr Version7.5.2

Cisco ≫ Ios Xr Version7.5.3

Cisco ≫ Ios Xr Version7.5.4

Cisco ≫ Ios Xr Version7.5.5

Cisco ≫ Ios Xr Version7.6.1

Cisco ≫ Ios Xr Version7.6.2

Cisco ≫ Ios Xr Version7.7.1

Cisco ≫ Ios Xr Version7.7.2

Cisco ≫ Ios Xr Version7.7.21

Cisco ≫ Ios Xr Version7.8.1

Cisco ≫ Ios Xr Version7.8.2

Cisco ≫ Ios Xr Version7.8.22

Cisco ≫ Ios Xr Version7.9.1

Cisco ≫ Ios Xr Version7.9.2

Cisco ≫ Ios Xr Version7.10.1

Cisco ≫ Ios Xr Version7.10.2

Cisco ≫ Ios Xr Version7.11.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.05%	0.16

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.8	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
psirt@cisco.com	4	2.2	1.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/

Technical Description

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs-hybridacl-crMZFfKQ

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-20144

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-20144

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-20144

EUVD