CVE-2025-20143

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-20143", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.215Z", "datePublished": "2025-03-12T16:12:31.135Z", "dateUpdated": "2026-02-26T19:09:35.340Z"}, "containers": {"cna": {"title": "Cisco IOS XR Software Secure Boot Bypass Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Secure Boot functionality and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device.\r\n\r\nThis vulnerability is due to insufficient verification of modules in the software load process. An attacker could exploit this vulnerability by manipulating the loaded binaries to bypass some of the integrity checks that are performed during the booting process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass the requirement to run Cisco-signed images or alter the security properties of the running system.\r\nNote: This vulnerability affects Cisco IOS XR Software, not the Secure Boot feature.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-lkm-zNErZjbZ", "name": "cisco-sa-sb-lkm-zNErZjbZ"}, {"url": "https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/", "name": "Crafting endless AS-PATHS in BGP"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-sb-lkm-zNErZjbZ", "discovery": "INTERNAL", "defects": ["CSCvx66790"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Verification of Cryptographic Signature", "type": "cwe", "cweId": "CWE-347"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"version": "6.5.3", "status": "affected"}, {"version": "6.5.2", "status": "affected"}, {"version": "6.5.92", "status": "affected"}, {"version": "6.5.1", "status": "affected"}, {"version": "6.5.15", "status": "affected"}, {"version": "6.6.2", "status": "affected"}, {"version": "7.0.1", "status": "affected"}, {"version": "6.6.25", "status": "affected"}, {"version": "6.6.1", "status": "affected"}, {"version": "6.6.11", "status": "affected"}, {"version": "6.5.93", "status": "affected"}, {"version": "6.6.12", "status": "affected"}, {"version": "7.0.0", "status": "affected"}, {"version": "7.1.1", "status": "affected"}, {"version": "7.0.90", "status": "affected"}, {"version": "6.6.3", "status": "affected"}, {"version": "6.7.1", "status": "affected"}, {"version": "7.0.2", "status": "affected"}, {"version": "7.1.15", "status": "affected"}, {"version": "7.2.0", "status": "affected"}, {"version": "7.2.1", "status": "affected"}, {"version": "7.1.2", "status": "affected"}, {"version": "6.7.2", "status": "affected"}, {"version": "7.1.25", "status": "affected"}, {"version": "6.6.4", "status": "affected"}, {"version": "7.3.1", "status": "affected"}, {"version": "7.1.3", "status": "affected"}, {"version": "6.7.3", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.2.2", "status": "affected"}, {"version": "6.8.1", "status": "affected"}, {"version": "7.4.15", "status": "affected"}, {"version": "7.3.2", "status": "affected"}, {"version": "7.5.1", "status": "affected"}, {"version": "7.4.16", "status": "affected"}, {"version": "7.3.27", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.5.2", "status": "affected"}, {"version": "7.6.15", "status": "affected"}, {"version": "7.3.3", "status": "affected"}, {"version": "7.7.1", "status": "affected"}, {"version": "6.8.2", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "7.3.4", "status": "affected"}, {"version": "6.7.35", "status": "affected"}, {"version": "6.9.1", "status": "affected"}, {"version": "7.6.2", "status": "affected"}, {"version": "7.8.1", "status": "affected"}, {"version": "7.5.3", "status": "affected"}, {"version": "7.7.2", "status": "affected"}, {"version": "6.9.2", "status": "affected"}, {"version": "7.8.2", "status": "affected"}, {"version": "7.5.4", "status": "affected"}, {"version": "7.8.22", "status": "affected"}, {"version": "7.7.21", "status": "affected"}, {"version": "7.3.5", "status": "affected"}, {"version": "7.5.5", "status": "affected"}, {"version": "7.3.6", "status": "affected"}, {"version": "7.8.23", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-03-12T16:12:31.135Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20143", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-13T03:55:22.156936Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T19:09:35.340Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20143", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-13T03:55:22.156936Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T15:31:05.215Z"}}], "cna": {"title": "Cisco IOS XR Software Secure Boot Bypass Vulnerability", "source": {"defects": ["CSCvx66790"], "advisory": "cisco-sa-sb-lkm-zNErZjbZ", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XR Software", "versions": [{"status": "affected", "version": "6.5.3"}, {"status": "affected", "version": "6.5.2"}, {"status": "affected", "version": "6.5.92"}, {"status": "affected", "version": "6.5.1"}, {"status": "affected", "version": "6.5.15"}, {"status": "affected", "version": "6.6.2"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.6.25"}, {"status": "affected", "version": "6.6.1"}, {"status": "affected", "version": "6.6.11"}, {"status": "affected", "version": "6.5.93"}, {"status": "affected", "version": "6.6.12"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.6.3"}, {"status": "affected", "version": "6.7.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.15"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "6.7.2"}, {"status": "affected", "version": "7.1.25"}, {"status": "affected", "version": "6.6.4"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.1.3"}, {"status": "affected", "version": "6.7.3"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "6.8.1"}, {"status": "affected", "version": "7.4.15"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.4.16"}, {"status": "affected", "version": "7.3.27"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.6.15"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.7.1"}, {"status": "affected", "version": "6.8.2"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "6.7.35"}, {"status": "affected", "version": "6.9.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.8.1"}, {"status": "affected", "version": "7.5.3"}, {"status": "affected", "version": "7.7.2"}, {"status": "affected", "version": "6.9.2"}, {"status": "affected", "version": "7.8.2"}, {"status": "affected", "version": "7.5.4"}, {"status": "affected", "version": "7.8.22"}, {"status": "affected", "version": "7.7.21"}, {"status": "affected", "version": "7.3.5"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "7.3.6"}, {"status": "affected", "version": "7.8.23"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-lkm-zNErZjbZ", "name": "cisco-sa-sb-lkm-zNErZjbZ"}, {"url": "https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/", "name": "Crafting endless AS-PATHS in BGP"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Secure Boot functionality and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device.\r\n\r\nThis vulnerability is due to insufficient verification of modules in the software load process. An attacker could exploit this vulnerability by manipulating the loaded binaries to bypass some of the integrity checks that are performed during the booting process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass the requirement to run Cisco-signed images or alter the security properties of the running system.\r\nNote: This vulnerability affects Cisco IOS XR Software, not the Secure Boot feature.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-347", "description": "Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-03-12T16:12:31.135Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20143", "state": "PUBLISHED", "dateUpdated": "2026-02-26T19:09:35.340Z", "dateReserved": "2024-10-10T19:15:13.215Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-03-12T16:12:31.135Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco IOS XR Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "6.5.3"}, {"status": "affected", "version": "6.5.2"}, {"status": "affected", "version": "6.5.92"}, {"status": "affected", "version": "6.5.1"}, {"status": "affected", "version": "6.5.15"}, {"status": "affected", "version": "6.6.2"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "6.6.25"}, {"status": "affected", "version": "6.6.1"}, {"status": "affected", "version": "6.6.11"}, {"status": "affected", "version": "6.5.93"}, {"status": "affected", "version": "6.6.12"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.0.90"}, {"status": "affected", "version": "6.6.3"}, {"status": "affected", "version": "6.7.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.1.15"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "6.7.2"}, {"status": "affected", "version": "7.1.25"}, {"status": "affected", "version": "6.6.4"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.1.3"}, {"status": "affected", "version": "6.7.3"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "6.8.1"}, {"status": "affected", "version": "7.4.15"}, {"status": "affected", "version": "7.3.2"}, {"status": "affected", "version": "7.5.1"}, {"status": "affected", "version": "7.4.16"}, {"status": "affected", "version": "7.3.27"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.5.2"}, {"status": "affected", "version": "7.6.15"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.7.1"}, {"status": "affected", "version": "6.8.2"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.3.4"}, {"status": "affected", "version": "6.7.35"}, {"status": "affected", "version": "6.9.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.8.1"}, {"status": "affected", "version": "7.5.3"}, {"status": "affected", "version": "7.7.2"}, {"status": "affected", "version": "6.9.2"}, {"status": "affected", "version": "7.8.2"}, {"status": "affected", "version": "7.5.4"}, {"status": "affected", "version": "7.8.22"}, {"status": "affected", "version": "7.7.21"}, {"status": "affected", "version": "7.3.5"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "7.3.6"}, {"status": "affected", "version": "7.8.23"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8E6CEEB-0908-4884-A51E-000000DE5E92", "versionEndExcluding": "7.9.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Secure Boot functionality and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device.\r\n\r\nThis vulnerability is due to insufficient verification of modules in the software load process. An attacker could exploit this vulnerability by manipulating the loaded binaries to bypass some of the integrity checks that are performed during the booting process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass the requirement to run Cisco-signed images or alter the security properties of the running system.\r\nNote: This vulnerability affects Cisco IOS XR Software, not the Secure Boot feature.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad en el proceso de arranque del software Cisco IOS XR podr\u00eda permitir que un atacante local autenticado con privilegios elevados eluda la funcionalidad de arranque seguro e instale software no verificado en un dispositivo afectado. Para explotar esta vulnerabilidad, el atacante debe tener privilegios de superusuario en el dispositivo afectado. Esta vulnerabilidad se debe a una verificaci\u00f3n insuficiente de los m\u00f3dulos durante la carga del software. Un atacante podr\u00eda explotarla manipulando los binarios cargados para eludir algunas de las comprobaciones de integridad que se realizan durante el arranque. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante controlar la configuraci\u00f3n de arranque, lo que le permitir\u00eda eludir el requisito de ejecutar im\u00e1genes firmadas por Cisco o modificar las propiedades de seguridad del sistema en ejecuci\u00f3n. Nota: Esta vulnerabilidad afecta al software Cisco IOS XR, no a la funci\u00f3n de arranque seguro. Cisco ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que la solucionen."}], "id": "CVE-2025-20143", "lastModified": "2026-06-17T08:40:46.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20143", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-13T03:55:22.156936Z", "version": "2.0.3"}}]}, "published": "2025-03-12T16:15:21.733", "references": [{"source": "psirt@cisco.com", "tags": ["Technical Description"], "url": "https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/"}, {"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-lkm-zNErZjbZ"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T15:26:23.633073+00:00", "updated": "2025-07-12T15:26:23.633121+00:00", "vendors": ["cisco", "cisco$PRODUCT$ios_xr_software"]}