Paper/Archive/CVE-2025-20221

CVE-2025-20221

Cisco Cisco IOS XE Software — A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypas…

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 50.7.507 × 2010.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters. This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by sending a crafted packet to the affected device. A successful exploit could allow the attacker to bypass the Layer 3 and Layer 4 traffic filters and inject a crafted packet into the network.

Affected

ProductAffectedFixed inSource

Cisco IOS XE Software16.12.13–CNA

Cisco IOS XE Software17.1.1–CNA

Cisco IOS XE Software17.1.1s–CNA

Cisco IOS XE Software17.1.1t–CNA

Cisco IOS XE Software17.1.3–CNA

Cisco IOS XE Software17.2.1–CNA

Cisco IOS XE Software17.2.1r–CNA

Cisco IOS XE Software17.2.1a–CNA

Cisco IOS XE Software17.2.1v–CNA

Cisco IOS XE Software17.2.2–CNA

Cisco IOS XE Software17.2.3–CNA

Cisco IOS XE Software17.3.1–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

cisco (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-bypass-HHUVujdn