CVE-2025-20221
published 2025-05-07CVE-2025-20221: A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4…
PriorityP263critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.42%
34.0th percentile
A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters.
This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by sending a crafted packet to the affected device. A successful exploit could allow the attacker to bypass the Layer 3 and Layer 4 traffic filters and inject a crafted packet into the network.
Affected
179 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect crafted packets attempting to bypass Layer 3 and Layer 4 traffic filters on Cisco IOS XE SD-WAN devices by monitoring for unexpected traffic that should have been filtered by configured ACLs or policy rules. ↗
- →Reference Cisco Bug ID CSCwn25087 when querying vendor threat intelligence feeds or internal ticketing for affected device identification. ↗
- ·The vulnerability is due to improper traffic filtering conditions on the affected device; review and validate all Layer 3/Layer 4 packet filter configurations on Cisco IOS XE SD-WAN deployments to ensure filters are enforced as expected. ↗
- ·Workarounds exist for this vulnerability in addition to software updates; consult the Cisco Security Advisory for specific workaround guidance applicable to your deployment. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_cisco5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco IOS XE SD-WAN Software Packet Filtering Bypass Vulnerability
vendor_cisco·2025-05-07·CVSS 5.3
CVE-2025-20221 [MEDIUM] CWE-200 Cisco IOS XE SD-WAN Software Packet Filtering Bypass Vulnerability
Cisco IOS XE SD-WAN Software Packet Filtering Bypass Vulnerability
A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters.
This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by sending a crafted packet to the affected device. A successful exploit could allow the attacker to bypass the Layer 3 and Layer 4 traffic filters and inject a crafted packet into the network.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/cont
Cisco
Cisco IOS XE SD-WAN Software Packet Filtering Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20221 Cisco IOS XE SD-WAN Software Packet Filtering Bypass Vulnerability
CVE-2025-20221: Cisco IOS XE SD-WAN Software Packet Filtering Bypass Vulnerability
A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters. This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by sending a crafted packet to the affected device. A successful exploit could allow the attacker to bypass the Layer 3 and Layer 4 traffic filters and inject a crafted packet into the network. Cisco has released software updates that address this vulnerability. There are
CVSS: 3.1
CWE: CWE-200, CWE-200
Bug IDs: CSCwn25087
GHSA
GHSA-5983-2qrf-rph2: A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and
ghsa_unreviewed·2025-05-07
CVE-2025-20221 [MEDIUM] CWE-200 GHSA-5983-2qrf-rph2: A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and
A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters.
This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by sending a crafted packet to the affected device. A successful exploit could allow the attacker to bypass the Layer 3 and Layer 4 traffic filters and inject a crafted packet into the network.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-07
Published