Skip to content
fr Sign in
7.4 High

CVE-2025-20189 A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation…

Description

A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper memory management when Cisco IOS XE Software is processing Address Resolution Protocol (ARP) messages. An attacker could exploit this vulnerability by sending crafted ARP messages at a high rate over a period of time to an affected device. A successful exploit could allow the attacker to exhaust system resources, which eventually triggers a reload of the active route switch processor (RSP). If a redundant RSP is not present, the router reloads.

Affected products and versions

Product Affected versions Fixed in
Cisco IOS XE Software 17.14 17.14.1a → 17.14.1 No fix stated
Cisco IOS XE Software 17.13 17.13.1a → 17.13.1 No fix stated
Cisco IOS XE Software 17.12 17.12.1w → 17.12.4 No fix stated
Cisco IOS XE Software 17.11 17.11.1a → 17.11.1 No fix stated
Cisco IOS XE Software 17.10 17.10.1a → 17.10.1 No fix stated
Cisco IOS XE Software 17.9 17.9.1w → 17.9.6 No fix stated
Cisco IOS XE Software 17.8 17.8.1a → 17.8.1 No fix stated
Cisco IOS XE Software 17.7 17.7.1a → 17.7.2 No fix stated
Cisco IOS XE Software 17.6 17.6.1w → 17.6.8 No fix stated
Show the 20 other branches
Product Affected versions Fixed in
Cisco IOS XE Software 17.5 17.5.1a → 17.5.1 No fix stated
Cisco IOS XE Software 17.4 17.4.1a → 17.4.2 No fix stated
Cisco IOS XE Software 17.3 17.3.1w → 17.3.8 No fix stated
Cisco IOS XE Software 17.2 17.2.1r → 17.2.3 No fix stated
Cisco IOS XE Software 17.1 17.1.1s → 17.1.3 No fix stated
Cisco IOS XE Software 16.12 16.12.1s → 16.12.13 No fix stated
Cisco IOS XE Software 16.11 16.11.1s → 16.11.2 No fix stated
Cisco IOS XE Software 16.10 16.10.1s → 16.10.3 No fix stated
Cisco IOS XE Software 16.9 16.9.1s → 16.9.8 No fix stated
Cisco IOS XE Software 16.8 16.8.1s → 16.8.3 No fix stated
Cisco IOS XE Software 16.7 16.7.1a → 16.7.4 No fix stated
Cisco IOS XE Software 16.6 16.6.1 → 16.6.10 No fix stated
Cisco IOS XE Software 16.5 16.5.1a → 16.5.3 No fix stated
Cisco IOS XE Software 16.4 16.4.1 → 16.4.3 No fix stated
Cisco IOS XE Software 16.3 16.3.1a → 16.3.11 No fix stated
Cisco IOS XE Software 16.2 16.2.1 → 16.2.2 No fix stated
Cisco IOS XE Software 16.1 16.1.1 → 16.1.3 No fix stated
Cisco IOS XE Software 3.18 3.18.0S → 3.18.9SP No fix stated
Cisco IOS XE Software 3.17 3.17.0S → 3.17.4S No fix stated
Cisco IOS XE Software 3.16 3.16.0S → 3.16.10S No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco IOS XE Software

The 248 CVEs of Cisco IOS XE Software →
CVE-2026-20311 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote… 6.3 Medium CVE-2026-20301 A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of… 8.6 High CVE-2026-20308 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote… 4.3 Medium CVE-2026-20273 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering… 8.6 High
Track this CVE