CVE-2025-20155

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1287

Affected software

VendorProductVersions
CiscoCisco IOS XE Software17.9.4; 17.9.5; 17.9.4a; 17.9.5a; 17.9.5b; 17.9.6; 17.9.6a; 17.9.5e; 17.9.5f; 17.12.1; 17.12.1w; 17.12.1a; 17.12.1x; 17.12.2; 17.12.3; 17.12.2a; 17.12.1y; 17.12.1z; 17.12.4; 17.12.3a

References

Timeline

Published
May 7, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-201569.9A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privCVE-2025-201575.9A vulnerability in certificate validation processing of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unautheCVE-2025-201584.4A vulnerability in the debug shell of Cisco Video Phone 8875 and Cisco Desk Phone 9800 Series could allow an authenticated, local attacker tCVE-2025-201595.3A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticCVE-2025-20167.8Ashlar-Vellum Cobalt VC6 File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execCVE-2025-201608.1A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticatedCVE-2025-201615.1A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OSCVE-2025-201628.6A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a fuCVE-2025-201638.7A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker CVE-2025-201648.3A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacCVE-2025-201657.5A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing oCVE-2025-201665.4A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remot
CVE-2025-20155: Medium severity, CVSS 6.0 | Vulnix