Strix
26.1K

CVE-2025-20155

MEDIUMCVSS 6/10EPSS 0.15%

Last modified

CVE-2025-20155 is a medium-severity vulnerability rated 6/10 on the CVSS scale. A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. EPSS estimates a 0.15% chance of exploitation in the next 30 days.

Description

A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system.

Metrics

CVSS 3.1
6/10

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS Probability
0.15%

4.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoIos Xe17.9.4
CiscoIos Xe17.9.4a
CiscoIos Xe17.9.5
CiscoIos Xe17.9.5a
CiscoIos Xe17.9.5b
CiscoIos Xe17.9.5e
CiscoIos Xe17.9.5f
CiscoIos Xe17.9.6
CiscoIos Xe17.9.6a
CiscoIos Xe17.11.99sw
CiscoIos Xe17.12.1
CiscoIos Xe17.12.1a
CiscoIos Xe17.12.1w
CiscoIos Xe17.12.1x
CiscoIos Xe17.12.1y
CiscoIos Xe17.12.1z
CiscoIos Xe17.12.1z1
CiscoIos Xe17.12.2
CiscoIos Xe17.12.2a
CiscoIos Xe17.12.3
CiscoIos Xe17.12.3a
CiscoIos Xe17.12.4
CiscoIos Xe17.12.4a
CiscoIos Xe17.12.4b
CiscoIos Xe17.13.1
CiscoIos Xe17.13.1a
CiscoIos Xe17.14.1
CiscoIos Xe17.14.1a

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-20155?
A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system.
How severe is CVE-2025-20155?
CVE-2025-20155 has a CVSS score of 6/10 (MEDIUM severity). The EPSS model estimates a 0.15% probability of exploitation in the next 30 days.
How do I fix CVE-2025-20155?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-20155?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST