SB2025031277 - Denial of service in Cisco IOS XR for ASR 9000 Series Routers

Description

This security bulletin contains information about 1 security vulnerability.

1) Input validation error (CVE-ID: CVE-2025-20142)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the IPv4 access control list (ACL) feature and quality of service (QoS) policy feature. A remote attacker can send specially crafted IPv4 unicast packets to the system and perform a denial of service (DoS) attack.

This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco IOS XR 64-bit Software and have a vulnerable configuration enabled for any of the installed line cards:

• ASR 9000 Series Aggregation Services Routers if they have a Lightspeed- or Lightspeed-Plus-based line card installed
• ASR 9902 Compact High-Performance Routers
• ASR 9903 Compact High-Performance Routers

Remediation

Install update from vendor's website.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv4uni-LfM3cfBu
• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwf56155