CVE-2025-20141 Cisco IOS XR Software Release 7.9.2 Denial of Service Vulnerabillity

High 7.4 Published 12 Mar 2025 Updated 21 Mar 2025

An unauthenticated adjacent attacker can cause a denial of service by sending specific packets to Cisco IOS XR devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20141?

CVE-2025-20141 is a high-severity denial of service vulnerability in Cisco Ios Xr, published on 12 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an unauthenticated, adjacent attacker to cause control plane traffic to stop working on multiple Cisco IOS XR platforms.  This vulnerability is due to incorrect handling of packets that are punted to the route processor. An attacker could exploit this vulnerability by sending traffic, which must be handled by the Linux stack on the route processor, to an affected device. A successful exploit could allow the attacker to cause control plane traffic to stop working, resulting in a denial of service (DoS) condition.

Weakness: CWE-770

Which versions are affected by CVE-2025-20141?

It affects 1 product.

Products include Cisco Ios Xr.

How do I fix CVE-2025-20141?

No fix has been published for CVE-2025-20141 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-20141 being exploited?

There is no known exploitation of CVE-2025-20141 in the wild and no public exploit code.

All Cisco Ios Xr vulnerabilities

Sources

Also known as GHSA-2wx7-j39g-4p6g.