CVE-2025-20340VulnerabilityPublished 10 Sep 2025

CVE-2025-20340: Cisco IOS XR Software · Uncontrolled Resource Consumption

Affects Cisco IOS XR SoftwareSource CVE Database V5

Not known to be exploited · CVSS 7.4 High.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.4High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.6% chance of exploitation in 30 days – higher than 50% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Cisco Cisco IOS XR Software	Affected =6.5.3 =6.5.29 =6.5.1 =6.6.1 =6.5.2 =6.5.92 =6.5.15 =6.6.2 =7.0.1 =6.6.25 =6.5.26 =6.6.11 =6.5.25 =6.5.28 =6.5.93 =6.6.12 =6.5.90 =7.0.0 =7.1.1 =7.0.90 =6.6.3 =6.7.1 =7.0.2 =7.1.15 =7.2.0 =7.2.1 =7.1.2 =6.7.2 =7.0.11 =7.0.12 =7.0.14 =7.1.25 =6.6.4 =7.2.12 =7.3.1 =7.1.3 =6.7.3 =7.4.1 =7.2.2 =6.7.4 =6.5.31 =7.3.15 =7.3.16 =6.8.1 =7.4.15 =6.5.32 =7.3.2 =7.5.1 =7.4.16 =7.3.27 =7.6.1 =7.5.2 =7.8.1 =7.6.15 =7.5.12 =7.8.12 =7.3.3 =7.7.1 =6.8.2 =7.3.4 =7.4.2 =6.7.35 =6.9.1 =7.6.2 =7.5.3 =7.7.2 =6.9.2 =7.9.1 =7.10.1 =7.8.2 =7.5.4 =6.5.33 =7.8.22 =7.7.21 =7.9.2 =7.3.5 =7.5.5 =7.11.1 =7.9.21 =7.10.2 =24.1.1 =7.6.3 =7.3.6 =7.5.52 =7.11.2 =24.2.1 =24.1.2 =24.2.11 =24.3.1 =24.4.1 =24.2.2 =7.8.23 =7.11.21 =24.2.20 =24.3.2 =24.4.10 =6.5.35 =25.1.1 =24.4.2 =24.3.20 =24.4.15 =6.5.351 =24.3.30 =6.5.352 =24.4.30	Fixed in–

AI-suggested

1. Immediate patching: Organizations should prioritize upgrading affected Cisco IOS XR devices to fixed versions provided by Cisco once available. Monitoring Cisco advisories for patches is critical. 2. Network segmentation: Restrict access to management interfaces by isolating them on dedicated VLANs or out-of-band management networks inaccessible to general users or untrusted devices. 3. ARP traffic rate limiting: Implement rate limiting or filtering on ARP traffic at network ingress points to management interfaces to prevent excessive ARP request floods. 4. Access control lists (ACLs): Apply strict ACLs on management interfaces to allow only trusted hosts and block unauthorized ARP traffic sources. 5. Monitoring and alerting: Deploy network monitoring tools to detect abnormal ARP traffic patterns indicative of an attack, enabling rapid response. 6. Incident response readiness: Prepare playbooks for DoS conditions affecting network devices, including fallback management access methods and device recovery procedures. 7. Vendor engagement: Engage with Cisco support for guidance and to obtain interim mitigations if patches are delayed. 8. Network architecture review: Evaluate and redesign network topology to minimize adjacency exposure to critical management interfaces, employing zero-trust principles where feasible.

Description

A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service (DoS) condition on an affected device.  This vulnerability is due to how Cisco IOS XR Software processes a high, sustained rate of ARP traffic hitting the management interface. Under certain conditions, an attacker could exploit this vulnerability by sending an excessive amount of traffic to the management interface of an affected device, overwhelming its ARP processing capabilities. A successful exploit could result in degraded device performance, loss of management connectivity, and complete unresponsiveness of the system, leading to a DoS condition.

Impact

For European organizations, the impact of CVE-2025-20340 can be substantial, particularly for enterprises, service providers, and critical infrastructure operators relying on Cisco IOS XR devices for core routing and network management. A successful DoS attack could disrupt network management access, delaying incident response and remediation efforts. This could lead to prolonged outages or degraded network performance, affecting business continuity and service availability. In sectors such as finance, telecommunications, energy, and government, where Cisco IOS XR routers are commonly deployed, such disruptions could have cascading effects on operational technology and critical services. The loss of management connectivity also increases the risk of further exploitation or misconfiguration during an incident. Given the vulnerability requires adjacency, internal network security controls and segmentation become crucial to limit exposure. However, in environments with flat network topologies or insufficient access controls, the risk of exploitation is higher. The vulnerability's impact on availability aligns with European regulatory requirements for network resilience and incident reporting, potentially triggering compliance and reputational risks if exploited.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-arp-storm-EjUU55yM (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Sep 2025, 16:12 UTC

Technical details

References

Community reviews

Related threats