PT-2025-20277 · Cisco · Cisco Ios Xe

Published 2025-05-07 · Updated 2025-08-05 · CVE-2025-20214

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the Network Configuration Access Control Module (NACM) could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This issue exists due to incorrect filtering of results caused by a change in inner API call behavior. An attacker could exploit this by using NETCONF, RESTCONF, or gRPC Network Management Interface (gNMI) protocols to query data on paths that may have been denied by the NACM configuration, potentially accessing restricted data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-20214

Affected Products

Cisco Ios Xe

References · 7

• https://osv.dev/vulnerability/CVE-2025-20214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20214 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-netconf-nacm-bypass-TGZV9pmQ · Vendor Advisory
• https://t.me/cvedetector/24744 · Telegram Post
• https://t.me/cvetracker/23280 · Telegram Post
• https://twitter.com/CVEnew/status/1920246416070349211 · Twitter Post
• https://t.me/cveNotify/130921 · Telegram Post