Cisco IOS XR Software CLI Privilege Escalation (cisco-sa-iosxr-priv-esc-GFQjxvOF)

#TRUSTED 4616ccb489c13480a0bd2a03869c66a50a8aecd5efabb3b26106a7fa6b756f09a1c557015b0caa42f114e9eb9afc45e47d7850c5fae0a0cbdf6a4787c6272fe171618e7beaaa61bedc72ae0bbb5a837342b2908d7899422d44c6d4b18fc86e38398cb87c39051ea29a8d94067a3ab267b95c1dd4f09957765bf2f76f3861b5e122f28d0dd43542ea2ecd1345b19a6f3ec5189cda25065820bde3e5bf35f1b565c468ed4c265332d177ede634a655d6318531956b960f002a3dd3f94133fc714420f3c75fbb7d3347cfaca3918a4b157fe3b136fb3fb9e995403a4176ab1cccd94247a0c71164d76dfc40e596efbbc49ebff197870ccbfeb26327bb017db1c2c29b42bad8da0070ca601a98c7fd32146a7fbb4b94c263dc77f3b58be185b9d287667acfc26533f9dc5ea35d32b954916024e4cabbd17387aaa663a886c13682334edebb1f26e4a2cb901aa9d5d64d929dbef3a4f7dd3550b8d1ebf5af203cf31adf8d0b92bfbe88bc0c39b46ecf97301b330426846142bc5e839c6ad9a0cb454b06c3bbd50129f436fa1775820d94c1d673fe39447a1224234a625484b1abcf765d49569fa3b39029d4c174dd44846b1331e4a52359767b4bff4ebe5c94f0694edc1d81a10b3dfdd3d11e332af125a830fd3207f9867392e47e11cda99fc0dd9d57853f0867b822f46ba13024a85c7cc1bdde7f971d4751f8b2398e7f42fe8bfd
#TRUST-RSA-SHA256 4fb836a9741a0da78dc2177be4ccc9464d2eb3a7f9e29159bf6d59f3970cbed05dceaa9f9da51ea981ad24f8295175ea51eaff29b28af3d6002655a89cf38ca3d2a75d66adca2f1b179fce923f39f72e25d7777c835150961b0764cf137ed44f4524cd48625ed6b4bb14480e12d58f4eb93a787902fa427f902053e097f6533d3980e5fb5fd0db4511c85180c76039553ff3c94072e7e22a85df97ab6ed66668a54b27c8f5f886985a1ed16e5561899d72150ec5e28f3aa2ce0ec4105cff73a8be72c7fc7a4256028b66ecec2f4673b0eb7db2fda8e084ffc02a00a2cc6788f55179d67b3811b2c4a5421f3678758d2c2ef2e5651a28a0b6ecd6bcc829a26da17dd81cb167d7e77e8d979463fd6cde8b439fa820ade1c9c7d0cfcbf963f3995880c20710ab4b85be80bde5a7463f3c599564d9544be3241193f20ac2e91151c2f8364656c1c80112f80c5e63539c2f62b6c5be3d97c3b61b8c54848349e0bb5ef22b373c66326c314caa336dd6ff523e28b259302c9fd0b84430d664ebc9f1128bf4400ddaa7229a76d5fa8f778e8ebd1111bb104cd03357254d72e3d0db3afaa052232787d33898e0cd95c016bb084e91b7174bb1e443f338047e1fec6014c3dd9e047efe203665efc7935f964a8eb10ddbc2bc890d21cec8b2e616ed763b9ba81d4eeaade69109cf137b306cf448e234169596430980347c6cd7cc5203562b
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(274616);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2025-20138");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwj33398");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm56977");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm85670");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm85686");
  script_xref(name:"CISCO-SA", value:"cisco-sa-iosxr-priv-esc-GFQjxvOF");
  script_xref(name:"IAVA", value:"2025-A-0159-S");

  script_name(english:"Cisco IOS XR Software CLI Privilege Escalation (cisco-sa-iosxr-priv-esc-GFQjxvOF)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XR is affected by a vulnerability.

  - A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to
    execute arbitrary commands as root on the underlying operating system of an affected device. This
    vulnerability is due to insufficient validation of user arguments that are passed to specific CLI
    commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted
    commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and
    execute arbitrary commands. (CVE-2025-20138)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-GFQjxvOF
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f091a92e");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75548
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?402ef3d6");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj33398");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm56977");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm85670");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm85686");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwj33398, CSCwm56977, CSCwm85670, CSCwm85686");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20138");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/03/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/10");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xr_version.nasl");
  script_require_keys("Host/Cisco/IOS-XR/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XR');

var reporting = make_array(
  'port'          , product_info['port'],
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwj33398, CSCwm56977, CSCwm85670, CSCwm85686',
  'disable_caveat', TRUE
);

vuln_ranges = [
  {'min_ver' : '1.0',  'fix_ver' : '24.2.21'},
  {'min_ver' : '24.3', 'fix_ver' : '24.4'}
];

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);