CVE-2025-20316

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-20316", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.253Z", "datePublished": "2025-09-24T17:16:45.155Z", "dateUpdated": "2025-09-24T17:28:43.201Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-09-24T17:16:45.155Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device.\r\n\r This vulnerability is due to the flooding of traffic from an unlearned MAC address on a switch virtual interface (SVI) that has an egress ACL applied. An attacker could exploit this vulnerability by causing the VLAN to flush its MAC address table. This condition can also occur if the MAC address table is full. A successful exploit could allow the attacker to bypass an egress ACL on an affected device."}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"version": "17.7.1", "status": "affected"}, {"version": "17.10.1", "status": "affected"}, {"version": "17.10.1b", "status": "affected"}, {"version": "17.8.1", "status": "affected"}, {"version": "17.9.1", "status": "affected"}, {"version": "17.9.2", "status": "affected"}, {"version": "17.9.3", "status": "affected"}, {"version": "17.9.4", "status": "affected"}, {"version": "17.9.5", "status": "affected"}, {"version": "17.9.4a", "status": "affected"}, {"version": "17.9.6", "status": "affected"}, {"version": "17.9.6a", "status": "affected"}, {"version": "17.9.7", "status": "affected"}, {"version": "17.11.1", "status": "affected"}, {"version": "17.12.1", "status": "affected"}, {"version": "17.12.2", "status": "affected"}, {"version": "17.12.3", "status": "affected"}, {"version": "17.12.4", "status": "affected"}, {"version": "17.12.5", "status": "affected"}, {"version": "17.13.1", "status": "affected"}, {"version": "17.14.1", "status": "affected"}, {"version": "17.15.1", "status": "affected"}, {"version": "17.15.2", "status": "affected"}, {"version": "17.15.3", "status": "affected"}, {"version": "17.15.2b", "status": "affected"}, {"version": "17.16.1", "status": "affected"}, {"version": "17.17.1", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Access Control", "type": "cwe", "cweId": "CWE-284"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cat9k-acl-L4K7VXgD", "name": "cisco-sa-cat9k-acl-L4K7VXgD"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-cat9k-acl-L4K7VXgD", "discovery": "EXTERNAL", "defects": ["CSCwo11541"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-24T17:28:32.049852Z", "id": "CVE-2025-20316", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T17:28:43.201Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20316", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-24T17:28:32.049852Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T17:28:36.114Z"}}], "cna": {"source": {"defects": ["CSCwo11541"], "advisory": "cisco-sa-cat9k-acl-L4K7VXgD", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"status": "affected", "version": "17.7.1"}, {"status": "affected", "version": "17.10.1"}, {"status": "affected", "version": "17.10.1b"}, {"status": "affected", "version": "17.8.1"}, {"status": "affected", "version": "17.9.1"}, {"status": "affected", "version": "17.9.2"}, {"status": "affected", "version": "17.9.3"}, {"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.9.5"}, {"status": "affected", "version": "17.9.4a"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.9.6a"}, {"status": "affected", "version": "17.9.7"}, {"status": "affected", "version": "17.11.1"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.5"}, {"status": "affected", "version": "17.13.1"}, {"status": "affected", "version": "17.14.1"}, {"status": "affected", "version": "17.15.1"}, {"status": "affected", "version": "17.15.2"}, {"status": "affected", "version": "17.15.3"}, {"status": "affected", "version": "17.15.2b"}, {"status": "affected", "version": "17.16.1"}, {"status": "affected", "version": "17.17.1"}]}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cat9k-acl-L4K7VXgD", "name": "cisco-sa-cat9k-acl-L4K7VXgD"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device.\r\n\r This vulnerability is due to the flooding of traffic from an unlearned MAC address on a switch virtual interface (SVI) that has an egress ACL applied. An attacker could exploit this vulnerability by causing the VLAN to flush its MAC address table. This condition can also occur if the MAC address table is full. A successful exploit could allow the attacker to bypass an egress ACL on an affected device."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-284", "description": "Improper Access Control"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-09-24T17:16:45.155Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20316", "state": "PUBLISHED", "dateUpdated": "2025-09-24T17:28:43.201Z", "dateReserved": "2024-10-10T19:15:13.253Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-09-24T17:16:45.155Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Cisco IOS XE Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "17.7.1"}, {"status": "affected", "version": "17.10.1"}, {"status": "affected", "version": "17.10.1b"}, {"status": "affected", "version": "17.8.1"}, {"status": "affected", "version": "17.9.1"}, {"status": "affected", "version": "17.9.2"}, {"status": "affected", "version": "17.9.3"}, {"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.9.5"}, {"status": "affected", "version": "17.9.4a"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.9.6a"}, {"status": "affected", "version": "17.9.7"}, {"status": "affected", "version": "17.11.1"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.5"}, {"status": "affected", "version": "17.13.1"}, {"status": "affected", "version": "17.14.1"}, {"status": "affected", "version": "17.15.1"}, {"status": "affected", "version": "17.15.2"}, {"status": "affected", "version": "17.15.3"}, {"status": "affected", "version": "17.15.2b"}, {"status": "affected", "version": "17.16.1"}, {"status": "affected", "version": "17.17.1"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device.\r\n\r This vulnerability is due to the flooding of traffic from an unlearned MAC address on a switch virtual interface (SVI) that has an egress ACL applied. An attacker could exploit this vulnerability by causing the VLAN to flush its MAC address table. This condition can also occur if the MAC address table is full. A successful exploit could allow the attacker to bypass an egress ACL on an affected device."}, {"lang": "es", "value": "Una vulnerabilidad en la programaci\u00f3n de la lista de control de acceso (ACL) de Cisco IOS XE Software para los Switches Cisco Catalyst de las series 9500X y 9600X podr\u00eda permitir a un atacante remoto no autenticado eludir una ACL configurada en un dispositivo afectado.\n\nEsta vulnerabilidad se debe a la inundaci\u00f3n de tr\u00e1fico desde una direcci\u00f3n MAC no aprendida en una interfaz virtual de switch (SVI) que tiene una ACL de salida aplicada. Un atacante podr\u00eda explotar esta vulnerabilidad al hacer que la VLAN vac\u00ede su tabla de direcciones MAC. Esta condici\u00f3n tambi\u00e9n puede ocurrir si la tabla de direcciones MAC est\u00e1 llena. Un exploit exitoso podr\u00eda permitir al atacante eludir una ACL de salida en un dispositivo afectado."}], "id": "CVE-2025-20316", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20316", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-24T17:28:32.049852Z", "version": "2.0.3"}}]}, "published": "2025-09-24T18:15:36.313", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cat9k-acl-L4K7VXgD"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"created": "2025-09-25T08:21:05.340158+00:00", "updated": "2025-09-25T08:21:05.340211+00:00", "vendors": ["cisco", "cisco$PRODUCT$ios_xe_software"]}