CVE-2025-20145
MEDIUMDescription
A vulnerability in the access control list (ACL) processing in the egress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability exists because certain packets are handled incorrectly when they are received on an ingress interface on one line card and destined out of an egress interface on another line card where the egress ACL is configured. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an egress ACL on the affected device. For more information about this vulnerability, see the section of this advisory. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Is your site exposed to CVE-2025-20145?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | ios_xr |
| cisco | 8608 |
| cisco | 8804 |
| cisco | 8808 |
| cisco | 8812 |
| cisco | 8818 |
| cisco | ncs_5504 |
| cisco | ncs_5508 |
| cisco | ncs_5516 |
References
Frequently Asked Questions
What is CVE-2025-20145? +
How severe is CVE-2025-20145? +
What products are affected by CVE-2025-20145? +
How do I check if I'm vulnerable to CVE-2025-20145? +
Related Vulnerabilities
The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows …
Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Information disclosure may occur due to improper permission and access controls to Video Analytics engine.
Permission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability.
Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.