CVE-2025-20155
Estado: AnalizadaMedia (6)—
A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system.
This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- Puntuación base: 6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.17%
- Percentil entre todas las CVEs puntuadas: 6
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-1287
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-20155",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-20155",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-05-08T03:56:35.764293Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 0.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco IOS XE Software",
"versions": [
{
"status": "affected",
"version": "17.9.4"
},
{
"status": "affected",
"version": "17.9.5"
},
{
"status": "affected",
"version": "17.9.4a"
},
{
"status": "affected",
"version": "17.9.5a"
},
{
"status": "affected",
"version": "17.9.5b"
},
{
"status": "affected",
"version": "17.9.6"
},
{
"status": "affected",
"version": "17.9.6a"
},
{
"status": "affected",
"version": "17.9.5e"
},
{
"status": "affected",
"version": "17.9.5f"
},
{
"status": "affected",
"version": "17.12.1"
},
{
"status": "affected",
"version": "17.12.1w"
},
{
"status": "affected",
"version": "17.12.1a"
},
{
"status": "affected",
"version": "17.12.1x"
},
{
"status": "affected",
"version": "17.12.2"
},
{
"status": "affected",
"version": "17.12.3"
},
{
"status": "affected",
"version": "17.12.2a"
},
{
"status": "affected",
"version": "17.12.1y"
},
{
"status": "affected",
"version": "17.12.1z"
},
{
"status": "affected",
"version": "17.12.4"
},
{
"status": "affected",
"version": "17.12.3a"
},
{
"status": "affected",
"version": "17.12.1z1"
},
{
"status": "affected",
"version": "17.12.4a"
},
{
"status": "affected",
"version": "17.12.4b"
},
{
"status": "affected",
"version": "17.13.1"
},
{
"status": "affected",
"version": "17.13.1a"
},
{
"status": "affected",
"version": "17.14.1"
},
{
"status": "affected",
"version": "17.14.1a"
},
{
"status": "affected",
"version": "17.11.99SW"
}
]
}
]
}
],
"published": "2025-05-07T18:15:37.330",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bootstrap-KfgxYgdh",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-1287"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system.\r\n\r This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator configures SD-Routing on the device. An attacker could exploit this vulnerability by modifying a bootstrap file generated by Cisco Catalyst SD-WAN Manager, loading it into the device flash, and then either reloading the device in a green field deployment in SD-WAN mode or configuring the device with SD-Routing. A successful exploit could allow the attacker to perform arbitrary file writes to the underlying operating system."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la carga de arranque del software Cisco IOS XE podría permitir que un atacante local autenticado escriba archivos arbitrarios en un sistema afectado. Esta vulnerabilidad se debe a una validación de entrada insuficiente del archivo de arranque que lee el software del sistema cuando un dispositivo se implementa por primera vez en modo SD-WAN o cuando un administrador configura SD-Routing en el dispositivo. Un atacante podría explotar esta vulnerabilidad modificando un archivo de arranque generado por Cisco Catalyst SD-WAN Manager, cargándolo en la memoria flash del dispositivo y, posteriormente, volviendo a cargar el dispositivo en una implementación inicial en modo SD-WAN o configurándolo con SD-Routing. Una explotación exitosa podría permitir al atacante realizar escrituras de archivos arbitrarias en el sistema operativo subyacente."
}
],
"lastModified": "2026-06-17T08:40:48.513",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E67BE408-8DCF-491F-9EA9-E368565C1B49"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9CFE98A-FBA5-4837-BBD9-3C875ECEBF1B"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36A5F20F-3F38-4FB9-B49D-28569EB1A763"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D2264D7-5E89-4F50-B948-FAB41D07C8BA"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5b:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BB8368D-B9F9-4679-8154-1174E140CA17"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5e:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78EEDF40-2CDA-4147-A9F2-A5F4B8FF35EC"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.5f:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40CEA4FC-B946-4D54-A45B-686FC02D5411"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7BDBE176-04ED-48F0-BA9F-45BECFEDBE2A"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.6a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94E52AA0-0A77-47DF-9600-7D5B8A6D09B6"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F7C157F-5569-4072-805F-7AF598F6B56F"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1BF0778B-015D-481B-BAC0-40667F3453D3"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1EEBC0EB-0DBB-4530-AFC4-AA0036469656"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1w:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "66D0DB87-6BB7-4FCF-BF20-6D4D48D72B79"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0A766E7-CF3C-4529-AFA4-D780059A66BC"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1y:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46B7F7EA-6512-433F-B1E4-B2F889427464"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1z:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "63527910-7F55-4D40-BFE7-D497C91C334D"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1z1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6EACA43F-64DB-496B-A6B1-DB9FAF6606EB"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE165207-A066-44C1-B78A-6EFD80023204"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.2a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4AF792BC-C270-4294-8E4E-71FAC3ACFCF8"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1098FCEA-6A9F-4634-A0EF-EC55ABCCEA3E"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.3a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53B97B06-206B-42F0-B68F-5C5136EAD2B1"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6281EB0F-EE0E-4B06-A7A1-29460A98A8CA"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.4a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07650346-67D7-4805-BF81-BB145304CC87"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.4b:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C6C0D21-ABD5-42F1-B04B-745CA6115D07"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.13.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8577AF01-F2C7-48D3-AB0B-78BD63A60029"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.13.1a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD0D2D94-6470-4E4B-A1B1-0124F92AA793"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.14.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31789E98-7C8D-4C5A-8A3F-FC9AFE9A248C"
},
{
"criteria": "cpe:2.3:o:cisco:ios_xe:17.14.1a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A62648B-3273-4D75-8533-A5CBE1B1BCE0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@cisco.com"
}