CVE-2025-20144: Cisco IOS XR Auth Bypass Vulnerability

CVE-2025-20144 Overview

CVE-2025-20144 is an access control vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software. An unauthenticated, remote attacker can bypass a configured ACL by sending crafted traffic through an affected device when a specific hybrid ACL configuration exists. The flaw affects a broad set of Cisco Network Convergence System (NCS) platforms, including NCS 540, NCS 5500, NCS 560, and NCS 5700 series routers. Cisco has published fixed software and documented workarounds in advisory cisco-sa-ncs-hybridacl-crMZFfKQ. The weakness is tracked as [CWE-284: Improper Access Control].

Critical Impact
Remote attackers can send traffic that bypasses configured hybrid ACLs, undermining a core network segmentation control on affected Cisco IOS XR routers.

Affected Products

Cisco IOS XR Software releases 6.5.1 through 7.11.1 on affected NCS platforms
Cisco NCS 540, 540X, 560, 5500 (NCS 5501, 5502, 5508, 5516), and NCS 5700 series (NCS 57B1, 57C1, 57C3, 57D2) routers
Only devices with a specific hybrid ACL configuration applied are exposed

Discovery Timeline

2025-03-12 - CVE-2025-20144 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20144

Vulnerability Analysis

The vulnerability exists in how Cisco IOS XR Software processes IPv4 packets against a hybrid ACL. Hybrid ACLs combine standard permit/deny entries with object-group or compressed match structures to reduce hardware resource consumption on high-density platforms. When a specific hybrid ACL configuration is programmed on an affected NCS device, the packet forwarding path evaluates matching entries incorrectly. Traffic that should be denied under the configured policy is instead permitted through the router.

The issue is a data-plane logic flaw, not a control-plane or authentication defect. Exploitation does not require credentials, user interaction, or a preexisting session on the device. An attacker only needs a network path through the affected router with a hybrid ACL applied to an interface.

Root Cause

The defect is classified under [CWE-284: Improper Access Control]. Incorrect handling of the compiled hybrid ACL structure causes the forwarding ASIC or software match engine to evaluate certain packet headers against the wrong entry, producing a permit result where a deny was configured. Only ACLs constructed in the specific hybrid form trigger the mismatch. Standard ACLs and pure object-group ACLs are not affected.

Attack Vector

Exploitation is network-based and unauthenticated. An attacker sends IPv4 packets addressed to destinations that should be filtered by the hybrid ACL. If the packet header combination matches the flawed evaluation path, the router forwards the traffic instead of dropping it. The scope is changed because the bypass grants access to downstream resources the ACL was intended to protect. Confidentiality and availability are not directly impacted, but integrity of the enforced policy is broken. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-20144

Indicators of Compromise

Flow records or NetFlow/IPFIX telemetry showing traffic to destinations that policy should have blocked at an affected NCS router
Successful TCP connections or ICMP responses from protected subnets that terminate behind a hybrid ACL boundary
Unexpected east-west or north-south sessions logged by downstream firewalls or IDS sensors positioned after the router

Detection Strategies

Audit ACL configurations on IOS XR devices for hybrid structures matching the pattern described in advisory cisco-sa-ncs-hybridacl-crMZFfKQ
Generate synthetic traffic against the ACL boundary and compare hit counters using show access-lists ipv4 <name> hardware ingress location <loc> to validate deny counts
Correlate router ACL hit statistics with downstream firewall permit logs to identify policy divergence

Monitoring Recommendations

Enable and centralize IOS XR syslog and SNMP notifications for ACL configuration changes and interface policy binding events
Continuously baseline flow data across ACL enforcement points to detect deviations from expected drop rates
Track advisory revisions on the Cisco Security Advisory page for updated fixed release information

How to Mitigate CVE-2025-20144

Immediate Actions Required

Identify all NCS platform routers running affected IOS XR releases and inventory interfaces with hybrid ACLs applied
Upgrade to a fixed IOS XR release as documented in the Cisco advisory
Where upgrades are not immediately feasible, reconfigure hybrid ACLs into a non-affected form as a temporary control
Layer defense with downstream firewalls or edge ACLs so that a single bypass does not expose protected assets

Patch Information

Cisco has released software updates that address CVE-2025-20144. Fixed release details, upgrade paths, and Software Maintenance Update (SMU) availability are documented in the Cisco Security Advisory cisco-sa-ncs-hybridacl-crMZFfKQ. Administrators should consult the Cisco Software Checker to confirm the fixed train for their specific platform and release.

Workarounds

Rewrite the affected hybrid ACL as a standard IPv4 ACL or a fully object-group-based ACL to avoid the flawed evaluation path
Apply compensating deny policies at adjacent enforcement points such as upstream routers or perimeter firewalls
Validate any workaround in a lab environment against the traffic patterns documented in the Cisco advisory before production rollout

bash

# Verify ACL hit counters on an affected IOS XR device
show access-lists ipv4 <acl-name> hardware ingress location <node-id>
show access-lists ipv4 <acl-name> usage pfilter location all