CVE-2025-20155

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-20155", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.216Z", "datePublished": "2025-05-07T17:37:05.984Z", "dateUpdated": "2026-02-26T18:28:48.301Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-05-07T17:37:05.984Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system.\r\n\r This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system."}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"version": "17.9.4", "status": "affected"}, {"version": "17.9.5", "status": "affected"}, {"version": "17.9.4a", "status": "affected"}, {"version": "17.9.5a", "status": "affected"}, {"version": "17.9.5b", "status": "affected"}, {"version": "17.9.6", "status": "affected"}, {"version": "17.9.6a", "status": "affected"}, {"version": "17.9.5e", "status": "affected"}, {"version": "17.9.5f", "status": "affected"}, {"version": "17.12.1", "status": "affected"}, {"version": "17.12.1w", "status": "affected"}, {"version": "17.12.1a", "status": "affected"}, {"version": "17.12.1x", "status": "affected"}, {"version": "17.12.2", "status": "affected"}, {"version": "17.12.3", "status": "affected"}, {"version": "17.12.2a", "status": "affected"}, {"version": "17.12.1y", "status": "affected"}, {"version": "17.12.1z", "status": "affected"}, {"version": "17.12.4", "status": "affected"}, {"version": "17.12.3a", "status": "affected"}, {"version": "17.12.1z1", "status": "affected"}, {"version": "17.12.4a", "status": "affected"}, {"version": "17.12.4b", "status": "affected"}, {"version": "17.13.1", "status": "affected"}, {"version": "17.13.1a", "status": "affected"}, {"version": "17.14.1", "status": "affected"}, {"version": "17.14.1a", "status": "affected"}, {"version": "17.11.99SW", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Validation of Specified Type of Input", "type": "cwe", "cweId": "CWE-1287"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bootstrap-KfgxYgdh", "name": "cisco-sa-bootstrap-KfgxYgdh"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-bootstrap-KfgxYgdh", "discovery": "INTERNAL", "defects": ["CSCwj60286"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-08T03:56:35.764293Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T18:28:48.301Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-07T18:56:14.350888Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-07T18:56:15.957Z"}}], "cna": {"source": {"defects": ["CSCwj60286"], "advisory": "cisco-sa-bootstrap-KfgxYgdh", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.9.5"}, {"status": "affected", "version": "17.9.4a"}, {"status": "affected", "version": "17.9.5a"}, {"status": "affected", "version": "17.9.5b"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.9.6a"}, {"status": "affected", "version": "17.9.5e"}, {"status": "affected", "version": "17.9.5f"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.1w"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.12.1x"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.12.2a"}, {"status": "affected", "version": "17.12.1y"}, {"status": "affected", "version": "17.12.1z"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.3a"}, {"status": "affected", "version": "17.12.1z1"}, {"status": "affected", "version": "17.12.4a"}, {"status": "affected", "version": "17.12.4b"}, {"status": "affected", "version": "17.13.1"}, {"status": "affected", "version": "17.13.1a"}, {"status": "affected", "version": "17.14.1"}, {"status": "affected", "version": "17.14.1a"}, {"status": "affected", "version": "17.11.99SW"}]}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bootstrap-KfgxYgdh", "name": "cisco-sa-bootstrap-KfgxYgdh"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system.\r\n\r This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-1287", "description": "Improper Validation of Specified Type of Input"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-05-07T17:37:05.984Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20155", "state": "PUBLISHED", "dateUpdated": "2025-05-08T03:56:34.728Z", "dateReserved": "2024-10-10T19:15:13.216Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-05-07T17:37:05.984Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Cisco IOS XE Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.9.5"}, {"status": "affected", "version": "17.9.4a"}, {"status": "affected", "version": "17.9.5a"}, {"status": "affected", "version": "17.9.5b"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.9.6a"}, {"status": "affected", "version": "17.9.5e"}, {"status": "affected", "version": "17.9.5f"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.1w"}, {"status": "affected", "version": "17.12.1a"}, {"status": "affected", "version": "17.12.1x"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.12.2a"}, {"status": "affected", "version": "17.12.1y"}, {"status": "affected", "version": "17.12.1z"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.3a"}, {"status": "affected", "version": "17.12.1z1"}, {"status": "affected", "version": "17.12.4a"}, {"status": "affected", "version": "17.12.4b"}, {"status": "affected", "version": "17.13.1"}, {"status": "affected", "version": "17.13.1a"}, {"status": "affected", "version": "17.14.1"}, {"status": "affected", "version": "17.14.1a"}, {"status": "affected", "version": "17.11.99SW"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*", "matchCriteriaId": "E67BE408-8DCF-491F-9EA9-E368565C1B49", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*", "matchCriteriaId": "D9CFE98A-FBA5-4837-BBD9-3C875ECEBF1B", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5:*:*:*:*:*:*:*", "matchCriteriaId": "36A5F20F-3F38-4FB9-B49D-28569EB1A763", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5a:*:*:*:*:*:*:*", "matchCriteriaId": "4D2264D7-5E89-4F50-B948-FAB41D07C8BA", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5b:*:*:*:*:*:*:*", "matchCriteriaId": "6BB8368D-B9F9-4679-8154-1174E140CA17", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5e:*:*:*:*:*:*:*", "matchCriteriaId": "78EEDF40-2CDA-4147-A9F2-A5F4B8FF35EC", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5f:*:*:*:*:*:*:*", "matchCriteriaId": "40CEA4FC-B946-4D54-A45B-686FC02D5411", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.6:*:*:*:*:*:*:*", "matchCriteriaId": "7BDBE176-04ED-48F0-BA9F-45BECFEDBE2A", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.6a:*:*:*:*:*:*:*", "matchCriteriaId": "94E52AA0-0A77-47DF-9600-7D5B8A6D09B6", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*", "matchCriteriaId": "6F7C157F-5569-4072-805F-7AF598F6B56F", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*", "matchCriteriaId": "1BF0778B-015D-481B-BAC0-40667F3453D3", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*", "matchCriteriaId": "1EEBC0EB-0DBB-4530-AFC4-AA0036469656", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1w:*:*:*:*:*:*:*", "matchCriteriaId": "66D0DB87-6BB7-4FCF-BF20-6D4D48D72B79", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1x:*:*:*:*:*:*:*", "matchCriteriaId": "E0A766E7-CF3C-4529-AFA4-D780059A66BC", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1y:*:*:*:*:*:*:*", "matchCriteriaId": "46B7F7EA-6512-433F-B1E4-B2F889427464", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1z:*:*:*:*:*:*:*", "matchCriteriaId": "63527910-7F55-4D40-BFE7-D497C91C334D", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1z1:*:*:*:*:*:*:*", "matchCriteriaId": "6EACA43F-64DB-496B-A6B1-DB9FAF6606EB", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.2:*:*:*:*:*:*:*", "matchCriteriaId": "EE165207-A066-44C1-B78A-6EFD80023204", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.2a:*:*:*:*:*:*:*", "matchCriteriaId": "4AF792BC-C270-4294-8E4E-71FAC3ACFCF8", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.3:*:*:*:*:*:*:*", "matchCriteriaId": "1098FCEA-6A9F-4634-A0EF-EC55ABCCEA3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.3a:*:*:*:*:*:*:*", "matchCriteriaId": "53B97B06-206B-42F0-B68F-5C5136EAD2B1", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.4:*:*:*:*:*:*:*", "matchCriteriaId": "6281EB0F-EE0E-4B06-A7A1-29460A98A8CA", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.4a:*:*:*:*:*:*:*", "matchCriteriaId": "07650346-67D7-4805-BF81-BB145304CC87", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.4b:*:*:*:*:*:*:*", "matchCriteriaId": "9C6C0D21-ABD5-42F1-B04B-745CA6115D07", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.13.1:*:*:*:*:*:*:*", "matchCriteriaId": "8577AF01-F2C7-48D3-AB0B-78BD63A60029", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.13.1a:*:*:*:*:*:*:*", "matchCriteriaId": "CD0D2D94-6470-4E4B-A1B1-0124F92AA793", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.14.1:*:*:*:*:*:*:*", "matchCriteriaId": "31789E98-7C8D-4C5A-8A3F-FC9AFE9A248C", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.14.1a:*:*:*:*:*:*:*", "matchCriteriaId": "7A62648B-3273-4D75-8533-A5CBE1B1BCE0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system.\r\n\r This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system."}, {"lang": "es", "value": "Una vulnerabilidad en la carga de arranque del software Cisco IOS XE podr\u00eda permitir que un atacante local autenticado escriba archivos arbitrarios en un sistema afectado. Esta vulnerabilidad se debe a una validaci\u00f3n de entrada insuficiente del archivo de arranque que lee el software del sistema cuando un dispositivo se implementa por primera vez en modo SD-WAN o cuando un administrador configura SD-Routing en el dispositivo. Un atacante podr\u00eda explotar esta vulnerabilidad modificando un archivo de arranque generado por Cisco Catalyst SD-WAN Manager, carg\u00e1ndolo en la memoria flash del dispositivo y, posteriormente, volviendo a cargar el dispositivo en una implementaci\u00f3n inicial en modo SD-WAN o configur\u00e1ndolo con SD-Routing. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante realizar escrituras de archivos arbitrarias en el sistema operativo subyacente."}], "id": "CVE-2025-20155", "lastModified": "2026-06-17T08:40:48.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20155", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-05-08T03:56:35.764293Z", "version": "2.0.3"}}]}, "published": "2025-05-07T18:15:37.330", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bootstrap-KfgxYgdh"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1287"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{}