VYPR
← All advisories
Medium severity6.0NVD Advisory· Published May 7, 2025· Updated Jun 17, 2026

CVE-2025-20155

CVE-2025-20155

Description

A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

31
  • Cisco Systems, Inc./iOS Xe28 versions
    cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*+ 27 more
    • cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.1w:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.1x:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.1y:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.1z1:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.1z:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.2:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.2a:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.3:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.3a:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.4:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.4a:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.12.4b:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.13.1:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.13.1a:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.14.1:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.14.1a:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.5:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.5a:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.5b:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.5e:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.5f:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.6:*:*:*:*:*:*:*
    • cpe:2.3:o:cisco:ios_xe:17.9.6a:*:*:*:*:*:*:*
  • Cisco Systems, Inc./IOS and IOS XE Softwarellm-fuzzy
  • Cisco Systems, Inc./Catalyst SD-WAN Managerllm-fuzzy
  • Cisco Systems, Inc./IOS XE Software for Cisco Merakicpe-rescue
    Range: 17.9.4

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.