CVE-2025-20155 — Improper Validation of Specified Type of Input in Cisco IOS XE Software

CWE-1287 — Improper Validation of Specified Type of Input4 documents4 sources

Severity

6.0MEDIUMNVD

EPSS

0.1%

top 70.24%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco IOS XE Software Cisco IOS XE

Timeline

PublishedMay 7

Description

A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manag…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 0.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_software28 versions+27

▶NVDcisco/ios_xe28 versions+27

🔴Vulnerability Details

CVEList

CVE-2025-20155: A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected↗2025-05-07

▶

GHSA

GHSA-5jcx-7jcf-9fw2: A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected↗2025-05-07

▶

📋Vendor Advisories

Cisco

Cisco IOS XE Software Bootstrap Arbitrary File Write Vulnerability↗2025-05-07

▶