CVE-2025-20339

MediumCVSS 5.8/10Last modified Sep 26, 2026

Description

A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the improper enforcement of the implicit deny all at the end of a configured ACL. An attacker could exploit this vulnerability by attempting to send unauthorized traffic to an interface on an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Cisco	Cisco SD-WAN vEdge Cloud	20.9.1; 20.9.1.1; 20.9.2; 20.9.3; 20.9.3.1; 20.9.2.2; 20.9.2.3; 20.9.4; 20.9.5; 20.9.5.1; 20.9.6; 20.9.5.3
Cisco	Cisco SD-WAN vEdge Router	20.3.1; 20.3.2; 20.4.1; 20.4.1.1; 20.3.3; 20.4.1.2; 20.4.2; 20.3.4; 20.3.5; 20.9.1; 20.3.6; 20.9.2; 20.3.7; 20.9.3; 20.3.3.2; 20.3.4.3; 20.9.3.1; 20.3.7.1; 20.3.5.1; 20.4.2.3

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-defaultacl-pSJk9nVF

Timeline

Published: Sep 24, 2025
Last modified: Sep 26, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-20349.8A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is CVE-2025-203407.4A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent at CVE-2025-203418.8A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated, remote attacker to elevate privileges to Administra CVE-2025-203425.4A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow CVE-2025-203437.5A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) cou CVE-2025-203447.2A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path CVE-2025-203454.9A vulnerability in the debug logging function of Cisco Duo Authentication Proxy could allow an authenticated, high-privileged, remote attack CVE-2025-203464.3A vulnerability in Cisco Catalyst Center could allow an authenticated, remote attacker to execute operations that should require Administrat CVE-2025-203475.4A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authent CVE-2025-203485.0A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authent CVE-2025-203498.8A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a re CVE-2025-20359.8A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown func