Cisco IOS/XE Vulnerability Allows Unauthorized Access to Confidential Data

Cisco has disclosed a high‑severity vulnerability (CVE-2025-20160) in its IOS and IOS XE platforms, arising from improper validation of the TACACS+ shared secret configuration. The flaw occurs when TACACS+ is enabled but no secret is set, allowing a network‑path attacker or machine‑in‑the‑middle adversary to intercept or manipulate authentication messages. Successful exploitation can grant unauthorized access to confidential information or full administrative control of affected routers and switches.

The advisory notes the affected products as Cisco IOS and IOS XE Software with TACACS+ configured without a shared secret, and assigns a CVSS 3.1 score of 8.1 (High). As a temporary measure, administrators should verify that every TACACS+ server configured on a device has a valid shared secret, using the command show running-config | include tacacs server|key, and plan an upgrade to a fixed IOS or IOS XE version at the earliest opportunity, according to Cisco. 25 September 2025