Lucene search
+L

CVE-2025-20221

🗓️ 07 May 2025 17:38:49Reported by ciscoType 
cve
 cve
🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 73 Views

Vulnerability in Cisco IOS XE SD-WAN allows remote attacker to bypass traffic filters.

Related
Detection
Affected
Refs
Social
NVD
Vulners
Node
OR
ciscoios_xeMatch16.12.13
ciscoios_xeMatch17.1.1
ciscoios_xeMatch17.1.1s
ciscoios_xeMatch17.1.1t
ciscoios_xeMatch17.1.3
ciscoios_xeMatch17.2.1
ciscoios_xeMatch17.2.1a
ciscoios_xeMatch17.2.1r
ciscoios_xeMatch17.2.1v
ciscoios_xeMatch17.2.2
ciscoios_xeMatch17.2.3
ciscoios_xeMatch17.3.1
ciscoios_xeMatch17.3.1a
ciscoios_xeMatch17.3.2
ciscoios_xeMatch17.3.2a
ciscoios_xeMatch17.3.3
ciscoios_xeMatch17.3.4
ciscoios_xeMatch17.3.4a
ciscoios_xeMatch17.3.5
ciscoios_xeMatch17.3.6
ciscoios_xeMatch17.3.7
ciscoios_xeMatch17.3.8
ciscoios_xeMatch17.3.8a
ciscoios_xeMatch17.4.1
ciscoios_xeMatch17.4.1a
ciscoios_xeMatch17.4.1b
ciscoios_xeMatch17.4.2
ciscoios_xeMatch17.5.1
ciscoios_xeMatch17.5.1a
ciscoios_xeMatch17.6.1
ciscoios_xeMatch17.6.1a
ciscoios_xeMatch17.6.1y
ciscoios_xeMatch17.6.2
ciscoios_xeMatch17.6.3
ciscoios_xeMatch17.6.3a
ciscoios_xeMatch17.6.4
ciscoios_xeMatch17.6.5
ciscoios_xeMatch17.6.5a
ciscoios_xeMatch17.6.6
ciscoios_xeMatch17.6.6a
ciscoios_xeMatch17.6.7
ciscoios_xeMatch17.6.8
ciscoios_xeMatch17.6.8a
ciscoios_xeMatch17.7.1
ciscoios_xeMatch17.7.1a
ciscoios_xeMatch17.7.2
ciscoios_xeMatch17.8.1
ciscoios_xeMatch17.8.1a
ciscoios_xeMatch17.9.1
ciscoios_xeMatch17.9.1a
ciscoios_xeMatch17.9.2
ciscoios_xeMatch17.9.2a
ciscoios_xeMatch17.9.3
ciscoios_xeMatch17.9.3a
ciscoios_xeMatch17.9.4
ciscoios_xeMatch17.9.4a
ciscoios_xeMatch17.9.5
ciscoios_xeMatch17.9.5a
ciscoios_xeMatch17.9.5b
ciscoios_xeMatch17.9.5e
ciscoios_xeMatch17.9.5f
ciscoios_xeMatch17.9.6
ciscoios_xeMatch17.9.6a
ciscoios_xeMatch17.10.1
ciscoios_xeMatch17.10.1a
ciscoios_xeMatch17.10.1b
ciscoios_xeMatch17.11.1
ciscoios_xeMatch17.11.1a
ciscoios_xeMatch17.12.1
ciscoios_xeMatch17.12.1a
ciscoios_xeMatch17.12.1z2
ciscoios_xeMatch17.12.2
ciscoios_xeMatch17.12.3
ciscoios_xeMatch17.12.3a
ciscoios_xeMatch17.12.4
ciscoios_xeMatch17.12.4a
ciscoios_xeMatch17.12.4b
ciscoios_xeMatch17.13.1
ciscoios_xeMatch17.13.1a
ciscoios_xeMatch17.14.1
ciscoios_xeMatch17.14.1a
ciscoios_xeMatch17.15.1
ciscoios_xeMatch17.15.1a
ciscoios_xeMatch17.15.1x
ciscoios_xeMatch17.15.2
ciscoios_xeMatch17.15.2b
ciscoios_xeMatch17.15.2c
ciscoios_xeMatch17.16.1
ciscoios_xeMatch17.16.1a
[
  {
    "vendor": "Cisco",
    "product": "Cisco IOS XE Software",
    "versions": [
      {
        "version": "16.12.13",
        "status": "affected"
      },
      {
        "version": "17.1.1",
        "status": "affected"
      },
      {
        "version": "17.1.1s",
        "status": "affected"
      },
      {
        "version": "17.1.1t",
        "status": "affected"
      },
      {
        "version": "17.1.3",
        "status": "affected"
      },
      {
        "version": "17.2.1",
        "status": "affected"
      },
      {
        "version": "17.2.1r",
        "status": "affected"
      },
      {
        "version": "17.2.1a",
        "status": "affected"
      },
      {
        "version": "17.2.1v",
        "status": "affected"
      },
      {
        "version": "17.2.2",
        "status": "affected"
      },
      {
        "version": "17.2.3",
        "status": "affected"
      },
      {
        "version": "17.3.1",
        "status": "affected"
      },
      {
        "version": "17.3.2",
        "status": "affected"
      },
      {
        "version": "17.3.3",
        "status": "affected"
      },
      {
        "version": "17.3.1a",
        "status": "affected"
      },
      {
        "version": "17.3.2a",
        "status": "affected"
      },
      {
        "version": "17.3.4",
        "status": "affected"
      },
      {
        "version": "17.3.5",
        "status": "affected"
      },
      {
        "version": "17.3.4a",
        "status": "affected"
      },
      {
        "version": "17.3.6",
        "status": "affected"
      },
      {
        "version": "17.3.7",
        "status": "affected"
      },
      {
        "version": "17.3.8",
        "status": "affected"
      },
      {
        "version": "17.3.8a",
        "status": "affected"
      },
      {
        "version": "17.4.1",
        "status": "affected"
      },
      {
        "version": "17.4.2",
        "status": "affected"
      },
      {
        "version": "17.4.1a",
        "status": "affected"
      },
      {
        "version": "17.4.1b",
        "status": "affected"
      },
      {
        "version": "17.5.1",
        "status": "affected"
      },
      {
        "version": "17.5.1a",
        "status": "affected"
      },
      {
        "version": "17.6.1",
        "status": "affected"
      },
      {
        "version": "17.6.2",
        "status": "affected"
      },
      {
        "version": "17.6.1a",
        "status": "affected"
      },
      {
        "version": "17.6.3",
        "status": "affected"
      },
      {
        "version": "17.6.1y",
        "status": "affected"
      },
      {
        "version": "17.6.3a",
        "status": "affected"
      },
      {
        "version": "17.6.4",
        "status": "affected"
      },
      {
        "version": "17.6.5",
        "status": "affected"
      },
      {
        "version": "17.6.6",
        "status": "affected"
      },
      {
        "version": "17.6.6a",
        "status": "affected"
      },
      {
        "version": "17.6.5a",
        "status": "affected"
      },
      {
        "version": "17.6.7",
        "status": "affected"
      },
      {
        "version": "17.6.8",
        "status": "affected"
      },
      {
        "version": "17.6.8a",
        "status": "affected"
      },
      {
        "version": "17.7.1",
        "status": "affected"
      },
      {
        "version": "17.7.1a",
        "status": "affected"
      },
      {
        "version": "17.7.2",
        "status": "affected"
      },
      {
        "version": "17.10.1",
        "status": "affected"
      },
      {
        "version": "17.10.1a",
        "status": "affected"
      },
      {
        "version": "17.10.1b",
        "status": "affected"
      },
      {
        "version": "17.8.1",
        "status": "affected"
      },
      {
        "version": "17.8.1a",
        "status": "affected"
      },
      {
        "version": "17.9.1",
        "status": "affected"
      },
      {
        "version": "17.9.2",
        "status": "affected"
      },
      {
        "version": "17.9.1a",
        "status": "affected"
      },
      {
        "version": "17.9.3",
        "status": "affected"
      },
      {
        "version": "17.9.2a",
        "status": "affected"
      },
      {
        "version": "17.9.3a",
        "status": "affected"
      },
      {
        "version": "17.9.4",
        "status": "affected"
      },
      {
        "version": "17.9.5",
        "status": "affected"
      },
      {
        "version": "17.9.4a",
        "status": "affected"
      },
      {
        "version": "17.9.5a",
        "status": "affected"
      },
      {
        "version": "17.9.5b",
        "status": "affected"
      },
      {
        "version": "17.9.6",
        "status": "affected"
      },
      {
        "version": "17.9.6a",
        "status": "affected"
      },
      {
        "version": "17.9.5e",
        "status": "affected"
      },
      {
        "version": "17.9.5f",
        "status": "affected"
      },
      {
        "version": "17.11.1",
        "status": "affected"
      },
      {
        "version": "17.11.1a",
        "status": "affected"
      },
      {
        "version": "17.12.1",
        "status": "affected"
      },
      {
        "version": "17.12.1a",
        "status": "affected"
      },
      {
        "version": "17.12.2",
        "status": "affected"
      },
      {
        "version": "17.12.3",
        "status": "affected"
      },
      {
        "version": "17.12.4",
        "status": "affected"
      },
      {
        "version": "17.12.3a",
        "status": "affected"
      },
      {
        "version": "17.12.1z2",
        "status": "affected"
      },
      {
        "version": "17.12.4a",
        "status": "affected"
      },
      {
        "version": "17.12.4b",
        "status": "affected"
      },
      {
        "version": "17.13.1",
        "status": "affected"
      },
      {
        "version": "17.13.1a",
        "status": "affected"
      },
      {
        "version": "17.14.1",
        "status": "affected"
      },
      {
        "version": "17.14.1a",
        "status": "affected"
      },
      {
        "version": "17.15.1",
        "status": "affected"
      },
      {
        "version": "17.15.1a",
        "status": "affected"
      },
      {
        "version": "17.15.2",
        "status": "affected"
      },
      {
        "version": "17.15.1x",
        "status": "affected"
      },
      {
        "version": "17.15.2c",
        "status": "affected"
      },
      {
        "version": "17.15.2b",
        "status": "affected"
      },
      {
        "version": "17.16.1",
        "status": "affected"
      },
      {
        "version": "17.16.1a",
        "status": "affected"
      }
    ]
  }
]

syedaquib77

Vulnerability Alert: Cisco SD-WAN Multiple Vulnerabilities (XSS, Filter Bypass) Timeline: Disclosure: 2025-05-07, Patch: 2025-05-09 cveId: CVE-2025-20147 baseScore: 5.4 cvssMetrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvssSeverity: Medium EPSS Percentile: 9.34% exploitMaturity: Proof-of-Concept affectedVersions: - Cisco Catalyst SD-WAN Manager releases 20.8 and earlier, up to 20.12 (for CVE-2025-20147) - Universal Cisco IOS XE Software 17.2.1r and later (in Controller mode) (for CVE-2025-20221) - Standalone SD-WAN releases from 16.9.1 to 16.12.4 (for CVE-2025-20221) - cEdge Routers with SNMP enabled on the tunnel 0 interface (for CVE-2025-20221) fixedVersions: - Cisco Catalyst SD-WAN Manager releases 20.13 and later (not vulnerable to CVE-2025-20147) - Disable unnecessary SNMP access (mitigation for CVE-2025-20221) - Apply a device access policy to block unsolicited SNMP traffic (mitigation for CVE-2025-20221) - Configure extended access control lists (ACLs) (mitigation) Attack Vectors: - XSS - Traffic Filter Bypass Summary: Two vulnerabilities affect Cisco SD-WAN products. CVE-2025-20147 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, allowing an authenticated remote attacker to inject malicious JavaScript due to improper input sanitization. This could lead to session hijacking, credential theft, or unauthorized actions. CVE-2025-20221 is a packet filtering bypass vulnerability in Cisco IOS XE SD-WAN software, enabling unauthenticated remote attackers to bypass Layer 3 and Layer 4 traffic filters by sending crafted packets due to improper filtering logic. Recommended Actions: - Upgrade to fixed software versions - Disable unnecessary SNMP access - Apply a device access policy to block unsolicited SNMP traffic - Configure extended access control lists (ACLs) to mitigate risks Related Resources: - https://t.co/3q4v8vujtu - https://t.co/ShXHzbUIWW - https://t.co/IfpQUtWAqq Tags: #Cisco #SD-WAN #XSS #FilterBypass #CVE-2025-20147 #CVE-2025-20221 #Vulnerability #Proof-of-Concept #Cybersecurity

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

17 Jun 2026 08:41Current
5.3Medium risk
Vulners AI Score5.3
CVSS 3.15.3 - 9.1
EPSS0.005
SSVC
73