CVE-2025-20145 is a medium-severity vulnerability in Cisco IOS XR Software affecting various Cisco 8000 and NCS 5500 series routers. It allows an unauthenticated, remote attacker to bypass configured egress Access Control Lists (ACLs) due to incorrect packet handling across line cards. The vulnerability has a CVSS score of 5.8 (Medium) and could lead to unauthorized traffic flow, though it does not impact confidentiality or availability. There is currently no public exploit code, active exploitation, or significant community discussion surrounding this CVE. Cisco has released software updates to address this issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.5.1CPE matchmatch criteria | cpe:2.3:o:cisco:ios_xr:6.5.1:*:*:*:*:*:*:* | ||
6.5.2CPE matchmatch criteria | cpe:2.3:o:cisco:ios_xr:6.5.2:*:*:*:*:*:*:* | ||
6.5.3CPE matchmatch criteria | cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:*:* | ||
6.5.92CPE matchmatch criteria | cpe:2.3:o:cisco:ios_xr:6.5.92:*:*:*:*:*:*:* | ||
6.5.93CPE matchmatch criteria | cpe:2.3:o:cisco:ios_xr:6.5.93:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.