{"id":"CVE-2025-20138","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-20138","generatedAt":"2026-10-28T01:48:10.570Z","title":"A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.","description":"A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands.","published":"2025-03-12T16:15:21.000Z","lastModified":"2026-06-17T08:40:45.000Z","status":"Analyzed","sourceIdentifier":"psirt@cisco.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-78"],"affected":["cisco/ios xr"],"epss":{"score":0.00231,"percentile":0.13824,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/","tags":["Technical Description"],"source":"psirt@cisco.com"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-GFQjxvOF","tags":["Vendor Advisory"],"source":"psirt@cisco.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-20138","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}