CVE-2025-20141: cisco cisco ios xr software

Vulnerability summary

CVE-2025-20141 is a high (CVSS 7.4) vulnerability in cisco cisco ios xr software. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.2% of scored vulnerabilities.

Timeline

1. 12-03-2025
   PublishedVulnerability first disclosed.
2. 21-03-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an unauthenticated, adjacent attacker to cause control plane traffic to stop working on multiple Cisco IOS XR platforms. This vulnerability is due to incorrect handling of packets that are punted to the route processor. An attacker could exploit this vulnerability by sending traffic, which must be handled by the Linux stack on the route processor, to an affected device. A successful exploit could allow the attacker to cause control plane traffic to stop working, resulting in a denial of service (DoS) condition.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.