Cisco has released a security advisory detailing a high-severity vulnerability affecting its IOS XR Software. The flaw, identified as CVE-2025-20138, carries a CVSS score of 8.8, indicating a significant risk.
The vulnerability resides within the Command Line Interface (CLI) of Cisco IOS XR Software. According to the advisory, it could allow “an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device“.
The root cause of this vulnerability lies in “insufficient validation of user arguments that are passed to specific CLI commands“. This lack of proper validation opens a door for attackers with low-privileged accounts to escalate their privileges. By using specially crafted commands at the CLI prompt, a successful exploit could grant an attacker root access, effectively giving them complete control over the affected system.
The vulnerability impacts Cisco IOS XR 64-bit Software across all device configurations. To determine if a specific Cisco software release is vulnerable, users are advised to consult the “Fixed Software” section of the advisory.
Cisco has confirmed that the following products are not affected by this vulnerability:
- IOS Software
- IOS XE Software
- IOS XR 32-bit Software
- NX-OS Software
Crucially, Cisco states that there are no workarounds available to mitigate this vulnerability. The only solution is to apply the necessary software updates provided by Cisco.
Cisco has released software updates to address this critical vulnerability. Customers are strongly advised to upgrade to the appropriate fixed software release as soon as possible.
Here’s a summary of the affected releases and the corresponding fixes:
- Cisco IOS XR Software Release 24.1 and earlier: Migrate to a fixed release.
- Cisco IOS XR Software Release 24.2: Upgrade to version 24.2.21 (future release).
- Cisco IOS XR Software Release 24.3: Migrate to a fixed release.
- Cisco IOS XR Software Release 24.4: Not affected.
As of the release of the advisory, “The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory“. However, the potential impact of this vulnerability is severe, making prompt patching essential.
Cisco customers are urged to review the security advisory in its entirety and take immediate action to protect their systems.
Related Posts:
- Cisco Smart Install Protocol was misused, tens of thousands of critical infrastructure may be attacked
- Cisco releases the security updates to fix RCE flaw in Cisco IOS XE Software
- Rockwell Automation Claims Cisco IOS Vulnerability Affects Its Industrial Switch
- Five Security Vulnerabilities Added to CISA’s KEV Catalog
