CVE-2025-20159

mediumpriority · track · 0EPSS 0.003 · 26 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.33% (26th) EPSS

CVSS 5.3 · medium

Is it mine?

91 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features. This vulnerability exists because management interface ACLs have not been supported on Cisco IOS XR Software Packet I/O infrastructure platforms for Linux-handled features such as SSH, NetConf, or gRPC. An attacker could exploit this vulnerability by attempting to send traffic to an affected device. A successful exploit could allow the attacker to bypass an ingress ACL that is applied on the management interface of the affected device.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco IOS XR Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · psirt@cisco.com USexploitability 3.9 · impact 1.4

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · NCSC-NL NL

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-284USCWE-284US

affected products (91)

Products and version ranges known to be affected.

Cisco IOS XR 8000 Series Routersall versionscert_bundDEcpe:/o:cisco:ios_xr:8000_series_routers
Cisco IOS XR ASR 9000 Series Aggregation Services Routersall versionscert_bundDEcpe:/o:cisco:ios_xr:asr_9000_series_aggregation_services_routers
Cisco IOS XR NCS 1010 Platformsall versionscert_bundDEcpe:/o:cisco:ios_xr:ncs_1010_platforms
Cisco IOS XR NCS 1014 Platformsall versionscert_bundDEcpe:/o:cisco:ios_xr:ncs_1014_platforms
Cisco IOS XR NCS 540 Series Routersall versionscert_bundDEcpe:/o:cisco:ios_xr:ncs_540_series_routers
Cisco IOS XR NCS 5500 Series Routersall versionscert_bundDEcpe:/o:cisco:ios_xr:ncs_5500_series_routers
Cisco IOS XR NCS 560 Series Routersall versionscert_bundDEcpe:/o:cisco:ios_xr:ncs_560_series_routers
Cisco IOS XR NCS 5700 Series Routersall versionscert_bundDEcpe:/o:cisco:ios_xr:ncs_5700_series_routers
Cisco IOS XR White box (IOSXRWBD)all versionscert_bundDEcpe:/o:cisco:ios_xr:white_box_%28iosxrwbd%29
Cisco IOS XR XRd vRoutersall versionscert_bundDEcpe:/o:cisco:ios_xr:xrd_vrouters
Cisco IOS XR XRv 9000 Routersall versionscert_bundDEcpe:/o:cisco:ios_xr:xrv_9000_routers
Cisco Cisco IOS XR Softwareall versionscisco_csafUS
Cisco Cisco IOS XR Software≤ 7.3.2enisa_euvdEU
Cisco Cisco IOS XR Software≤ 6.5.1enisa_euvdEU
Cisco Cisco IOS XR Software≤ 7.4.1enisa_euvdEU
Cisco Cisco IOS XR Software≤ 6.5.3enisa_euvdEU
Cisco Cisco IOS XR Software≤ 7.3.5enisa_euvdEU
Cisco Cisco IOS XR Software≤ 7.8.22enisa_euvdEU
Cisco Cisco IOS XR Software≤ 7.6.1enisa_euvdEU
Cisco Cisco IOS XR Software≤ 7.7.21enisa_euvdEU

showing 20 of 91

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2025-0286Kwetsbaarheden verholpen in Cisco IOS XR SoftwareNL2025-09-11csaf · ncsc_nlNL
Cisco heeft kwetsbaarheden verholpen in Cisco IOS XR Software.
WID-SEC-W-2025-2032Cisco IOS XR: Mehrere SchwachstellenDeutsch2025-09-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Cisco IOS XR ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial-of-Service-Zustand zu verursachen.
cisco-sa-acl-packetio-SwjhhbtzCisco IOS XR Software Management Interface ACL Bypass Vulnerability2025-09-10csaf · cisco_csafUS
A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features. This vulnerability exists because management interface ACLs have not been supported on Cisco IOS XR Software Packet I/O infrastructure platforms for Linux-handled features such as SSH, NetConf, or gRPC. An attacker could exploit this vulnerability by attempting to send traffic to an affected device. A successful exploit could allow the attacker to bypass an ingress ACL that is applied on the management interface of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is part of the September 2025 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75549"].

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisco_csaf ncsc_nl NVD CVE.org MITRE

published 2025-09-10modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan