{"id":2610,"date":"2025-03-15T10:04:30","date_gmt":"2025-03-15T10:04:30","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/03\/15\/cisco-warns-of-ios-xr-software-vulnerability-that-let-attackers-trigger-dos-condition\/"},"modified":"2025-03-15T10:04:30","modified_gmt":"2025-03-15T10:04:30","slug":"cisco-warns-of-ios-xr-software-vulnerability-that-let-attackers-trigger-dos-condition","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/03\/15\/cisco-warns-of-ios-xr-software-vulnerability-that-let-attackers-trigger-dos-condition\/","title":{"rendered":"Cisco Warns of IOS XR Software Vulnerability That Let Attackers Trigger DoS condition"},"content":{"rendered":"

Cisco Warns of IOS XR Software Vulnerability That Let Attackers Trigger DoS condition
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cisco has issued security advisories for multiple vulnerabilities affecting its IOS XR Software, with particular emphasis on a significant memory corruption vulnerability in the Border Gateway Protocol (BGP) confederation implementation.\u00a0<\/p>\n

The vulnerability tracked as CVE-2025-20115, with a CVSS score of 8.6, could allow unauthenticated, remote attackers to cause denial-of-service conditions on affected network infrastructure.<\/p>\n

The BGP confederation vulnerability (cisco-sa-iosxr-bgp-dos-O7stePhX) stems from memory corruption that occurs when a BGP update contains an AS_CONFED_SEQUENCE attribute with 255 autonomous system numbers or more.\u00a0<\/p>\n

This buffer overflow<\/a> vulnerability, classified as CWE-120, represents a significant threat to network stability for organizations using Cisco IOS XR with BGP confederation configured.<\/p>\n

Cisco IOS XR Software Vulnerability<\/strong><\/h2>\n

According to Cisco\u2019s security advisory released<\/a> on March 12, 2025, an attacker could exploit this vulnerability by sending crafted BGP update<\/a> messages to trigger memory corruption, which may force the BGP process to restart and result in a network-wide denial of service condition.\u00a0<\/p>\n

The exploit path requires the attacker to control a BGP confederation speaker within the same autonomous system as the target or requires a network configuration where the AS_CONFED_SEQUENCE attribute naturally grows beyond the threshold size.<\/p>\n

The vulnerability affects all Cisco IOS XR Software versions with BGP confederation enabled, including versions 7.11 and earlier, 24.1 and earlier, and 24.2 up to 24.2.20.<\/p>\n

\n\n\n\n\n\n\n\n
Risk Factors<\/strong><\/td>\nDetails<\/strong><\/td>\n<\/tr>\n
Affected Products<\/td>\nCisco IOS XR Software 7.11 and earlier, 24.1 and earlier, and 24.2 up to 24.2.20.<\/td>\n<\/tr>\n
Impact<\/td>\nComplete denial of service<\/td>\n<\/tr>\n
Exploit Prerequisites<\/td>\nAttacker must control a BGP confederation speaker within the same autonomous system as the victim<\/td>\n<\/tr>\n
CVSS 3.1 Score<\/td>\n8.6 (High)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Mitigations<\/strong><\/h2>\n

Cisco has released software updates that address this vulnerability. Organizations using affected versions of IOS XR should upgrade to version 24.2.21 (future release), 24.3.1, or 24.4, which are unaffected.<\/p>\n

For organizations unable to update immediately, Cisco has provided a workaround that restricts the BGP AS_CONFED_SEQUENCE attribute to 254 or fewer AS numbers using a routing policy that drops BGP updates with long AS path lengths on confederation peers.\u00a0<\/p>\n

The policy implementation involves creating a max-asns route policy and applying it to BGP neighbors:<\/p>\n

\"\"<\/figure>\n

This policy should then be applied to BGP neighbor configurations using \u201cpolicy max-asns in\u201d and \u201cpolicy max-asns out\u201d directives.<\/p>\n

Network administrators<\/a> can determine if their devices are vulnerable by checking for BGP confederation configuration using the \u201cshow running-config router bgp\u201d command. If \u201cbgp confederation peers\u201d appear in the output, the device may be vulnerable.<\/p>\n

Cisco\u2019s Product Security Incident Response Team (PSIRT) notes they are not aware of any malicious exploitation attempts in the wild.<\/p>\n

Organizations using affected versions should apply the relevant updates as soon as possible or implement the available workaround to restrict the BGP AS_CONFED_SEQUENCE attribute to 254 or fewer AS numbers.<\/p>\n

Are you from SOC\/DFIR Teams? \u2013 Analyse Malware Incidents & get live Access with ANY.RUN ->\u00a0Start Now for Free<\/a>.<\/strong><\/code><\/strong><\/strong>\u00a0<\/p>\n

The post Cisco Warns of IOS XR Software Vulnerability That Let Attackers Trigger DoS condition<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Cisco Warns of IOS XR Software Vulnerability That Let Attackers Trigger DoS condition Cisco has issued security advisories for multiple vulnerabilities affecting its IOS XR Software, with particular emphasis on a significant memory corruption vulnerability in the Border Gateway Protocol (BGP) confederation implementation.\u00a0 The vulnerability tracked as CVE-2025-20115, with a CVSS score of 8.6, could […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,648],"tags":[130],"class_list":["post-2610","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2610"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=2610"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2610\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=2610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=2610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=2610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}