Cisco SD-WAN vEdge Software Access Control List Bypass Vulnerability
A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the improper enforcement of the implicit deny all at the end of a configured ACL. An attacker could exploit this vulnerability by attempting to send unauthorized traffic to an interface on an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-20339US | — | — | ||
A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to bypass a configured AC… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- BehobenCisco SD-WAN vEdge Cloud
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco SD-WAN vEdge Router
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco SD-WAN vEdge Cloud
There is a workaround that addresses this vulnerability. Administrators should determine which ACL best suits their needs and then configure that single ACL type on the interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
- WorkaroundCisco SD-WAN vEdge Router
There is a workaround that addresses this vulnerability. Administrators should determine which ACL best suits their needs and then configure that single ACL type on the interface. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan