Riskcovery

CVE-2025-20159

Cisco IOS XR Software Management Interface ACL Bypass Vulnerability

State
Published
Severity
5.3 Medium
Published
Sep 10, 2025
Updated
Sep 10, 2025
Reserved
Oct 10, 2024

Read the record on cve.org

Description

A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features.

This vulnerability exists because management interface ACLs have not been supported on Cisco IOS XR Software Packet I/O infrastructure platforms for Linux-handled features such as SSH, NetConf, or gRPC. An attacker could exploit this vulnerability by attempting to send traffic to an affected device. A successful exploit could allow the attacker to bypass an ingress ACL that is applied on the management interface of the affected device.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Ncisco

Weaknesses

Affected Products

ProductVersions
Cisco IOS XR SoftwareCisco
  • 6.6.1Affected
  • 6.5.3Affected
  • 7.0.1Affected
  • 6.6.11Affected
  • 6.5.1Affected
  • 6.5.2Affected
  • 6.6.2Affected
  • 6.6.12Affected
  • 6.6.25Affected
  • 7.1.1Affected
  • 7.0.90Affected
  • 6.6.3Affected
  • 7.0.2Affected
  • 7.1.2Affected
  • 7.2.1Affected
  • 7.0.11Affected
  • 7.0.12Affected
  • 7.0.14Affected
  • 6.6.4Affected
  • 7.2.12Affected
  • 7.3.1Affected
  • 7.4.1Affected
  • 7.2.2Affected
  • 7.3.15Affected
  • 7.3.16Affected
  • and 49 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.