CVE-2025-20221

State: Published
Severity: 5.3 Medium
Published: May 7, 2025
Updated: May 7, 2025
Reserved: Oct 10, 2024

Description

A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters. This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by sending a crafted packet to the affected device. A successful exploit could allow the attacker to bypass the Layer 3 and Layer 4 traffic filters and inject a crafted packet into the network.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	cisco

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Cisco IOS XE SoftwareCisco	16.12.13Affected 17.1.1Affected 17.1.1sAffected 17.1.1tAffected 17.1.3Affected 17.2.1Affected 17.2.1rAffected 17.2.1aAffected 17.2.1vAffected 17.2.2Affected 17.2.3Affected 17.3.1Affected 17.3.2Affected 17.3.3Affected 17.3.1aAffected 17.3.2aAffected 17.3.4Affected 17.3.5Affected 17.3.4aAffected 17.3.6Affected 17.3.7Affected 17.3.8Affected 17.3.8aAffected 17.4.1Affected 17.4.2Affected and 64 more versions

Product

Versions

Cisco IOS XE SoftwareCisco

16.12.13Affected
17.1.1Affected
17.1.1sAffected
17.1.1tAffected
17.1.3Affected
17.2.1Affected
17.2.1rAffected
17.2.1aAffected
17.2.1vAffected
17.2.2Affected
17.2.3Affected
17.3.1Affected
17.3.2Affected
17.3.3Affected
17.3.1aAffected
17.3.2aAffected
17.3.4Affected
17.3.5Affected
17.3.4aAffected
17.3.6Affected
17.3.7Affected
17.3.8Affected
17.3.8aAffected
17.4.1Affected
17.4.2Affected
and 64 more versions

References

cisco-sa-snmp-bypass-HHUVujdn

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.