High severity8.8NVD Advisory· Published Mar 12, 2025· Updated Jun 17, 2026
CVE-2025-20138
CVE-2025-20138
Description
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:x64:*+ 1 more
- cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:x64:*range: <24.2.21
- (no CPE)
6.5.3+ 1 more
- (no CPE)range: 6.5.3
- (no CPE)
Patches
Vulnerability mechanics
References
2- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-GFQjxvOFnvdVendor Advisory
- blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/nvdTechnical Description
News mentions
0No linked articles in our index yet.