September 12, 2025 By Pierluigi Paganini
Cisco addressed multiple high-severity IOS XR vulnerabilities that can allow ISO image verification bypass and trigger DoS conditions.
Cisco addressed multiple vulnerabilities in IOS XR software as part of its semiannual Software Security Advisory Bundled Publication published on September 10, 2025.
Below are the vulnerabilities addressed by the network giant:
The following table identifies Cisco Security content that is associated with this bundled publication:
| Cisco Security Advisory | CVE ID | Security Impact Rating | CVSS Base Score |
|---|---|---|---|
| Cisco IOS XR ARP Broadcast Storm Denial of Service Vulnerability | CVE-2025-20340 | High | 7.4 |
| Cisco IOS XR Software Image Verification Bypass Vulnerability | CVE-2025-20248 | High | 6 |
| Cisco IOS XR Software Management Interface ACL Bypass Vulnerability | CVE-2025-20159 | Medium | 5.3 |
The most severe of these vulnerabilities is a high-severity issue, tracked as CVE-2025-20340, that resides in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software. An unauthenticated, adjacent attacker can exploit the flaw to trigger a broadcast storm, triggering a denial of service (DoS) condition on an affected device.
