CVE-2025-20144

Cisco IOS XR Software Access Control List Bypass Vulnerability

MEDIUM

5.8

CVSS Score

Published: March 12, 2025 at 04:12 PM UTC

Updated: June 17, 2026 at 08:40 AM UTC

39 products affected across 1 vendorIOS XrNcs 5508Ncs 5501

Using Cisco IOS XR Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS XR Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect handling of packets when a specific configuration of the hybrid ACL exists. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass a configured ACL on the affected device. For more information, see the section of this advisory. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS Xr · Cisco

95%

cisco-ncs-540-12z20g-sys-a (environment) · cisco-ncs-540-12z20g-sys-d (environment) · cisco-ncs-540-24q2c2dd-sys (environment) · cisco-ncs-540-24q8l2dd-sys (environment) · cisco-ncs-540-24z8q2c-sys (environment) · cisco-ncs-540-28z4c-sys-a (environment) · cisco-ncs-540-28z4c-sys-d (environment) · cisco-ncs-540-6z14s-sys-d (environment) · cisco-ncs-540-6z18g-sys-a (environment) · cisco-ncs-540-6z18g-sys-d (environment) · cisco-ncs-540-acc-sys (environment) · cisco-ncs-540-fh-agg (environment) · cisco-ncs-540-fh-csr-sys (environment) · cisco-ncs-540x-12z16g-sys-a (environment) · cisco-ncs-540x-12z16g-sys-d (environment) · cisco-ncs-540x-16z4g8q2c-a (environment) · cisco-ncs-540x-16z4g8q2c-d (environment) · cisco-ncs-540x-16z8q2c-d (environment) · cisco-ncs-540x-4z14g2q-a (environment) · cisco-ncs-540x-4z14g2q-d (environment) · cisco-ncs-540x-6z18g-sys-a (environment) · cisco-ncs-540x-6z18g-sys-d (environment) · cisco-ncs-540x-8z16g-sys-a (environment) · cisco-ncs-540x-8z16g-sys-d (environment) · cisco-ncs-540x-acc-sys (environment) · cisco-ncs-5501 (environment) · cisco-ncs-5501-se (environment) · cisco-ncs-5502 (environment) · cisco-ncs-5502-se (environment) · cisco-ncs-5508 (environment) · cisco-ncs-5516 (environment) · cisco-ncs-560-4 (environment) · cisco-ncs-560-7 (environment) · cisco-ncs-57b1-5dse-sys (environment) · cisco-ncs-57b1-6d24-sys (environment) · cisco-ncs-57c1-48q6-sys (environment) · cisco-ncs-57c3-mod-sys (environment) · cisco-ncs-57d2-18dd-sys (environment)

Ncs 540-12Z20G-Sys-A · Ciscodevice

80%

All versions

Ncs 540-12Z20G-Sys-D · Ciscodevice

80%

All versions

Ncs 540-24Q2C2Dd-Sys · Ciscodevice

80%

All versions

Ncs 540-24Q8L2Dd-Sys · Ciscodevice

80%

All versions