CVE-2025-20115

CVE-2025-20115 describes a denial-of-service vulnerability in Cisco IOS XR Software's Border Gateway Protocol (BGP) confederation implementation. This memory corruption flaw occurs when a BGP update contains an AS_CONFED_SEQUENCE attribute with 255 or more autonomous system numbers. An unauthenticated, remote attacker can exploit this by sending a crafted BGP update or through specific network configurations, causing the BGP process to restart. The vulnerability has a CVSS score of 8.6 (High), indicating a network-based attack with low complexity and no user interaction required, leading to high availability impact. While an attacker needs to control a BGP confederation speaker within the same AS or rely on network design, the potential for a denial-of-service condition is significant. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting limited public awareness or immediate threat, despite its high severity rating.