dbcve.org
Ios XrOperating system · Cisco

CVE-2025-20143

MEDIUM · 6.7 CVSS v3.1 Published 2025-03-12
Fix available
A fix is available. Upgrade to 7.9.1 or later.
See remediation →
69/100
Remediation priority · Elevated
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Secure Boot functionality and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device. This vulnerability is due to insufficient verification of modules in the software load process. An attacker could exploit this vulnerability by manipulating the loaded binaries to bypass some of the integrity checks that are performed during the booting process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass the requirement to run Cisco-signed images or alter the security properties of the running system. Note: This vulnerability affects Cisco IOS XR Software, not the Secure Boot feature. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is a local privilege escalation vulnerability in Cisco IOS XR Software where an authenticated attacker with root-system privileges can bypass integrity checks in the boot process by manipulating loaded binaries. The attacker exploits insufficient verification of modules during the software load process to control boot configuration and run unsigned software, bypassing the requirement for Cisco-signed images.

MitigationApply the Cisco software update for IOS XR to address this vulnerability. No workarounds exist; affected systems must be patched. Coordinate maintenance window for the update deployment.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Ios XrOperating system
Affected:< 7.9.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the installed Cisco IOS XR version
    Execute 'show version' or 'admin show version' in the IOS XR CLI to retrieve the running software version
    Affected if The displayed version is any release prior to 7.9.1 (e.g., 7.8.x, 7.7.x, etc.)
  2. Confirm root-system privilege accounts exist
    Use 'show running-config | include username' or 'admin show running-config user' to list configured users, then verify which accounts have root-system privilege via 'show privilege' or by reviewing user group assignments
    Affected if Any user account with root-system or administrator-level privileges is configured on the device (this is the prerequisite for exploitation)
  3. Review boot configuration for integrity verification settings
    Examine the boot configuration using 'show boot-config' or by inspecting the configuration register and boot variables via 'show boot' to see what integrity checks are configured
    Affected if Boot integrity verification is disabled, weakly configured, or allows manual intervention in the boot process
  4. Check for unsigned or unverified modules in the running configuration
    Use 'admin show software integrity' or 'show module' commands to list loaded modules and their verification status; look for any modules flagged as unsigned, unverified, or failing signature checks
    Affected if Any module or software package loaded on the system fails integrity/signature verification or was loaded without cryptographic validation

A system is affected if it runs Cisco IOS XR version prior to 7.9.1 and has at least one account with root-system privileges, allowing an authenticated attacker to bypass boot integrity checks and load unsigned software.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 7.9.1 or later
Fixed in 7.9.1
Interim mitigation

Apply the Cisco software update for IOS XR to address this vulnerability. No workarounds exist; affected systems must be patched. Coordinate maintenance window for the update deployment.

Recommended fix High confidence

Cisco IOS XR 7.9.1 or later

  1. Log into the Cisco IOS XR device and identify the current software version using the command: show version
  2. Review Cisco IOS XR release notes for version 7.9.1 to ensure compatibility with your hardware platform and existing configurations
  3. Access Cisco.com software downloads (requires valid Cisco service contract) and download the IOS XR 7.9.1 or later software image for your specific hardware platform
  4. Backup the current running configuration using the command: copy running-config nvram:startup-config or copy running-config <remote-location>
  5. Schedule a maintenance window as upgrades require a system reload
  6. Install the new software image. For IOS XR, use the install command sequence: install add source <directory> <tar-file> then install activate, and finally install commit
  7. After installation completes, the system will automatically reload with the new image
  8. Verify the upgrade was successful by running: show version and confirm the version is 7.9.1 or later
Caveat Review release notes for any command syntax changes or feature modifications between your current version and 7.9.1

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Ios Xr Scoped from the published advisory
  • Consultation4.0 h
  • Implementation6.0 h
  • Testing3.0 h
  • Review / QA2.0 h
15.0 hours of engineering $2,690
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,304.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-20143 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-20143 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data