Cisco fixes high-severity IOS XR flaws enabling image bypass and DoS

Cisco has addressed multiple high-severity IOS XR vulnerabilities as part of its semiannual Software Security Advisory Bundled Publication published on 10 September 2025, which cover ARP-related issues, image verification bypasses and management-interface access controls.

The most severe flaw, CVE-2025-20340, affects the ARP implementation and could let an unauthenticated, adjacent attacker trigger a broadcast storm and cause a DoS condition by sending excessive ARP traffic to the device’s management interface; Cisco notes this vulnerability has a CVSS base score of 7.4.

A second high-severity issue, CVE-2025-20248, allows attackers with root-system privileges to bypass image signature checks and load unsigned files into an ISO image during installation, potentially enabling activation of tampered software. Also fixed is CVE-2025-20159, a medium-severity flaw (CVSS 5.3) that lets remote attackers bypass ACLs for SSH, NetConf and gRPC due to missing ACL support on the management interface. Cisco says it is not aware of any attacks in the wild exploiting these vulnerabilities.