CVE-2025-20143

CVE-2025-20143 is a medium-severity vulnerability in Cisco IOS XR Software that allows an authenticated, local attacker with root-system privileges to bypass Secure Boot and load unverified software. This is due to insufficient verification during the software load process, enabling an attacker to manipulate binaries and control the boot configuration. A successful exploit could allow the attacker to run unsigned images or alter system security properties. While no active exploits or public exploit code exist, the vulnerability has garnered some community discussion and media coverage, and Cisco has released software updates to address it.