CVE-2025-20144 — MEDIUM (4.0)

Vulnerability Description

A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect handling of packets when a specific configuration of the hybrid ACL exists. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass a configured ACL on the affected device. For more information, see the section of this advisory. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

CVSS Score

4.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Cisco	Ios Xr	6.5.1
Cisco	Ncs 540-12Z20G-Sys-A	-
Cisco	Ncs 540-12Z20G-Sys-D	-
Cisco	Ncs 540-24Q2C2Dd-Sys	-
Cisco	Ncs 540-24Q8L2Dd-Sys	-
Cisco	Ncs 540-24Z8Q2C-Sys	-
Cisco	Ncs 540-28Z4C-Sys-A	-
Cisco	Ncs 540-28Z4C-Sys-D	-
Cisco	Ncs 540-6Z14S-Sys-D	-
Cisco	Ncs 540-6Z18G-Sys-A	-
Cisco	Ncs 540-6Z18G-Sys-D	-
Cisco	Ncs 540-Acc-Sys	-
Cisco	Ncs 540-Fh-Agg	-
Cisco	Ncs 540-Fh-Csr-Sys	-
Cisco	Ncs 540X-12Z16G-Sys-A	-
Cisco	Ncs 540X-12Z16G-Sys-D	-
Cisco	Ncs 540X-16Z4G8Q2C-A	-
Cisco	Ncs 540X-16Z4G8Q2C-D	-
Cisco	Ncs 540X-16Z8Q2C-D	-
Cisco	Ncs 540X-4Z14G2Q-A	-

Related Weaknesses (CWE)

CWE-284

References

https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/Technical Description
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciVendor Advisory

FAQ

What is CVE-2025-20144?

CVE-2025-20144 is a vulnerability with a CVSS score of 4.0 (MEDIUM). A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerab...

How severe is CVE-2025-20144?

CVE-2025-20144 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-20144?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xr, Cisco Ncs 540-12Z20G-Sys-A, Cisco Ncs 540-12Z20G-Sys-D, Cisco Ncs 540-24Q2C2Dd-Sys, Cisco Ncs 540-24Q8L2Dd-Sys.