CVE-2025-20209 Cisco IOS XR Software Internet Key Exchange Version 2 Denial of Service Vulnerability

High 7.5 Published 12 Mar 2025 Updated 12 Mar 2025

Remote attackers can cause denial of service on Cisco IOS XR devices by sending malformed IKEv2 packets, blocking control plane UDP processing.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20209?

CVE-2025-20209 is a high-severity denial of service vulnerability in Cisco Ios Xr, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Internet Key Exchange version 2 (IKEv2) function of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent an affected device from processing any control plane UDP packets.  This vulnerability is due to improper handling of malformed IKEv2 packets. An attacker could exploit this vulnerability by sending malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to prevent the affected device from processing any control plane UDP packets, resulting in a denial of service (DoS) condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Weakness: CWE-770

Which versions are affected by CVE-2025-20209?

It affects 1 product.

Products include Cisco Ios Xr.

How do I fix CVE-2025-20209?

No fix has been published for CVE-2025-20209 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-20209 being exploited?

There is no known exploitation of CVE-2025-20209 in the wild and no public exploit code.

All Cisco Ios Xr vulnerabilities

Sources

Also known as GHSA-f769-hvjj-2wv2.