CVE-2025-20151: Cisco IOS XE SD-WAN Auth Bypass Flaw

CVE-2025-20151 Overview

Cisco disclosed CVE-2025-20151, a vulnerability in the Simple Network Management Protocol Version 3 (SNMPv3) implementation of Cisco IOS Software and Cisco IOS XE Software. The flaw allows an authenticated, remote attacker with valid SNMPv3 credentials to poll an affected device even when the configuration should deny SNMP traffic from that source, or when the SNMPv3 username has been removed from the running configuration.

The root cause lies in how SNMPv3 configuration is stored in the startup configuration. An attacker exploiting this issue can perform SNMP operations from a source address that administrators believed was blocked.

Critical Impact
Authenticated attackers can bypass SNMP access controls to poll device information from denied source addresses, undermining network segmentation policies on Cisco IOS and IOS XE devices.

Affected Products

Cisco IOS Software with SNMPv3 configured
Cisco IOS XE Software with SNMPv3 configured
Cisco IOS XE SD-WAN releases 16.9.x through 16.12.x

Discovery Timeline

2025-05-07 - CVE-2025-20151 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20151

Vulnerability Analysis

The vulnerability affects the SNMPv3 subsystem in Cisco IOS and IOS XE Software. SNMPv3 provides authenticated and encrypted access to device management data, and administrators typically restrict access using access control lists (ACLs) tied to SNMPv3 users and groups. This vulnerability breaks that assumption.

An authenticated attacker holding valid SNMPv3 user credentials can send polling requests from a source address that ACLs should deny. The device processes those requests as if the source were permitted. The same behavior occurs after an administrator removes an SNMPv3 username from the configuration, leaving stale authorization state intact.

The issue is classified under [CWE-16] (Configuration) and [CWE-1284] (Improper Validation of Specified Quantity in Input). The attacker cannot alter the SNMPv3 configuration itself, which limits the scope to information disclosure and integrity impact on SNMP-accessible objects.

Root Cause

The defect stems from how SNMPv3 configuration is persisted in the Cisco IOS and IOS XE startup configuration. Configuration state that should be invalidated when ACLs change or when users are removed continues to authorize SNMP operations. The running device does not fully reconcile the effective SNMPv3 authorization state against source-address restrictions or user-deletion events.

Attack Vector

Exploitation requires network reachability to the SNMP service on UDP/161 and valid SNMPv3 user credentials. The attacker sends standard SNMP GET, GETNEXT, or GETBULK requests from a source address that the configured ACL should reject. Because the vulnerability is a configuration-handling flaw rather than a protocol parsing bug, no crafted packet or exploit tooling is required. Refer to the Cisco Security Advisory for the complete list of fixed releases and configuration conditions.

Detection Methods for CVE-2025-20151

Indicators of Compromise

SNMPv3 authentication events (%SNMP-3-AUTHFAIL or successful poll logs) originating from source addresses that appear in deny ACLs applied to snmp-server statements.
Successful SNMPv3 GET/GETNEXT/GETBULK responses to users that have been removed from the running configuration.
Unexpected SNMP traffic on UDP/161 from management subnets that were explicitly restricted.

Detection Strategies

Correlate SNMPv3 request logs from device syslog with the current ACL configuration and flag any authenticated poll from a denied source.
Compare the running configuration against the startup configuration to identify SNMPv3 users, groups, and views that persist across reloads.
Perform periodic authenticated SNMPv3 polls from test hosts on denied subnets to confirm ACL enforcement after configuration changes.

Monitoring Recommendations

Forward Cisco IOS and IOS XE syslog and SNMP audit events to a centralized analytics platform for baseline comparison.
Alert on SNMPv3 operations from any source outside the sanctioned network management VLAN.
Track configuration changes to snmp-server user, snmp-server group, and associated ACLs to detect stale entries retained in startup configuration.

How to Mitigate CVE-2025-20151

Immediate Actions Required

Apply the fixed Cisco IOS or IOS XE software release listed in the vendor advisory as soon as change windows allow.
Rotate SNMPv3 credentials for any user that was previously removed from the configuration but remained in startup configuration.
Restrict SNMP reachability at upstream firewalls and control-plane policing (CoPP) policies until patched software is deployed.

Patch Information

Cisco has published fixed software releases in the Cisco Security Advisory cisco-sa-snmpv3-qKEYvzsy. Administrators should consult the advisory's Fixed Software section to select the appropriate IOS, IOS XE, or IOS XE SD-WAN train and upgrade affected devices. No workarounds fully resolve the issue; upgrading is the vendor-recommended remediation.

Workarounds

Enforce SNMP source restrictions at the network perimeter and on transit devices, not only on the target device.
Remove unused SNMPv3 users and then explicitly write and reload the configuration to ensure the startup configuration reflects the intended state.
Consider disabling SNMPv3 polling on internet-exposed or untrusted interfaces until the fixed software is in place.

bash

# Example: tighten SNMPv3 access and clear stale state on Cisco IOS/IOS XE
configure terminal
 no snmp-server user <removed-user> <group> v3
 access-list 99 permit host 10.10.10.5
 access-list 99 deny   any log
 snmp-server group OPS v3 priv access 99
 snmp-server user OPS_ADMIN OPS v3 auth sha <auth-pass> priv aes 256 <priv-pass> access 99
end
write memory
reload