CVE-2025-20160

Severity
8.1HIGH
EPSS
0.1%
top 78.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 24

Description

A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required TACACS+ shared secret is configured. A machine-in-the-middle attacker could exploit this vulnerability by intercepting and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and fal

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

CVEListV5cisco/cisco_ios_xe_software235 versions+234
CVEListV5cisco/ios124 versions+123

🔴Vulnerability Details

2
GHSA
GHSA-g4wr-69xr-36p6: A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote a2025-09-24
CVEList
CVE-2025-20160: A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote a2025-09-24

📋Vendor Advisories

1
Cisco
Cisco IOS and IOS XE Software TACACS+ Authentication Bypass Vulnerability2025-09-24
CVE-2025-20160 (HIGH CVSS 8.1) | A vulnerability in the implementati | cvebase.io