Cisco IOS XR Software Management Interface ACL Bypass (cisco-sa-acl-packetio-Swjhhbtz)

#TRUSTED 2efbef4a86f286f500623cc2d890970a493628d7743d31e92c91e49422b1b5ea172743e99552bd4a217959eca69d2066ee3a75bdfec3dabe531cb9b69ce735d015ad8019d81f1d0c4f8e6948aa9e87586585af36cf4f75bd7f1ee7a132942bd94e53743225a2c4fcd825c3e4d2e864dfc82cffa0939070e41742e0ea506be5e862d9dcfe8f6cfdb4339a2dbaac096c9c06d14800debe8cdf1fee9037fe15f9ad6e67fef1cb9c84862e62886a99e02aba815affc0da12b6e76e639472c2b1e31d9be5ae7dbc97e2aafc7e3e91b8cc4061c8d41e15d9b6cbf39df155c75f6f620cb9436fc931724dcd9d518c86f3c5b1d689c61b11a65b40faf0ebda1e17731a18735da4ff4d3918235a6ab0948c380b83faec0ff4032660f84e310bd76ba07a6ef59ccb96dcb687d848103b8f713a30a833015bddf133254d109d61435a59896a8766dd6ad74ca1e5a57f0207ac298696b021761f94c62afca848e22e65f85e0e8b663198385eb873fdb1f52f47138dbddc9837e890ea148c51d85ef102d3b6701f0317bd41a2dc5f89fd04bc76e1ee9e35607cc3b69b9e79dad7e084714e7b49265a59dfc5088a7abca475b04feecc983ab6d8a2b4eea554e2e785c987c8fd1253fa3f4030f24b6dcb57ad1d997fd039037f71ecfa6524e3a29504172e803a005b5c3d3bfd03023051e14773008c679ad0e1a582f3bd9eb8dec310984b79a2ad
#TRUST-RSA-SHA256 0a2e8c91a9e36c55adf521c2a3b55c3e98526814c06e8ad0c7d3de3c7c6b2f9b51858f742a79762243443cb0310e569892adacc66142c72a832a8ef8ad4e525102c8c2a8f76251cf60799eee66d3832deb8dab0930ff37dbbfb7c60434365a9c3496af1a3a6f763729c8414b51f95ccd8e19be4db49820106102f88fe9afef55ed17e74a14bfc48d78d407002fc16d33b516a063e8400cd43d133b6ef51c4440343f3822d165e9a823d2a942cabe162590d153def31f9b1c64c3c366789a725f889ae080a0ad21e15f93d6e8a3a16eba3198cfe6af2d9521f232d41f131352870c57997f8c1967214c1dbbece1727f19655beecbb8b87f570764162296955dd57c7d44f09c7d63228f6ad288364b1f7c9ffcbbad48f7249d3d9d7412ceabd682cf40da341d4ea6ff24359c1fc59ddf4926f27cb4aba8f78e5325d919d37aa1fa11def5e7bfb671434451ab1fdaf08529546e4c8d2c3721ad961bd555be18e52cf9933ba069228f55e52cbf303805a2131243aba72eeb7adecfebfb80d45e40a6006caec20f60252c6e64fc4afa58e6f62472ab924d026b11ec338f05899193a90bf1ca17c4355f21d5028861d646eaf21657cb2e713f24605946021d49b426de0086b36d2e6da1348e8c00d22b4de97b47a0ebddfd2d356c030f45524e85dcb55b6d5b52e4509006fbef45c090ce93d46ec2bbfd9d867dbdf5f2427fd4e09cd1
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(266351);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/01");

  script_cve_id("CVE-2025-20159");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwb70861");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo51041");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo52518");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwq48170");
  script_xref(name:"CISCO-SA", value:"cisco-sa-acl-packetio-Swjhhbtz");

  script_name(english:"Cisco IOS XR Software Management Interface ACL Bypass (cisco-sa-acl-packetio-Swjhhbtz)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XR is affected by a vulnerability.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-acl-packetio-Swjhhbtz
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4866f2d8");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75549
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3017dffe");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb70861");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo51041");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo52518");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwq48170");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwb70861, CSCwo51041, CSCwo52518, CSCwq48170");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20159");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/01");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xr_version.nasl", "cisco_enum_smu.nasl");
  script_require_keys("Host/Cisco/IOS-XR/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XR');
if (report_paranoia < 2) audit(AUDIT_POTENTIAL_VULN, 'Cisco IOS XR Software', product_info.version);
var vuln_ranges;

vuln_ranges = vuln_ranges = [
  {'min_ver':'0.0', 'fix_ver':'25.1.2'},
  {'min_ver':'25.2', 'fix_ver':'25.2.1'}
];

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_WARNING,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwb70861, CSCwo51041, CSCwo52518, CSCwq48170',
  'fix'     , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);