Cisco IOS XR Software Release 7.9.2 DoS (cisco-sa-xr792-bWfVDPY)

#TRUSTED 664faaa3beb8089123f576686d0d8beaff6600cc4498735c086cfd1d83be1ff6395cc0d0506eab9bdc076b9ae8bdd7caa792533d572946573e7bee1078e2f0d03f536042a2ec5314c38204997ebda984378dc0d32c246f1a3820910390015801a2c30021ab71529f01f0e0b307d27f3c90482b8942f060f2c274bdffeae80325a0b931b3f68ee4a6a6b4303314a7097beff712939c246ee85c71a53015c588440261a9662c439eae45ba588e3c05d1fb40197495317d115d81ad2d197323a7f9c801a8735dbd31c9ae3fffa178459dd2677b275c84958d6508bd7cefd5d9e0fa2dbe88269514ada00b7bac99c07a77daa991879bf6a68daf079b779574b8dbe31e0cec5d1eae507d91fa88caac5ffef4ffa7d955df56cc5494fd6c4beb166b39870f9c1e54a8cda7c9403ef3186a97806026eb834daa97e26c16f789a268e5907b094ca14574f2d6ebd8a74b3a3fa474b9f04e65bf8503f6490e71542ab2c09eb9e4cad78770c8e2c9584c4ab1d414ff31bf3e789375ad3eac6b2bea9eee52ce7d0b2551d7f2eb18d9750dc9e0bc982747894b6824cfa1a52551315eaa15581ca133e0df7b575dc4717836f9f633b23db68fcfb5f49f62addd5d220dd8da0529e4b150f57ef231ecf063c988b6ff876d8f6b8c8108dbf92c5df144e156d3665ba77797ce65f89084a04af270cc34fd82363760f9eb9d526fcc8f298123ef4860
#TRUST-RSA-SHA256 2dcc38b825cf504c90482b3fffe52b93951c783611b20c64040c46cad4675b3512e794fb5a7483dbc05fb35478ea4d6ab698e74db2617b82e270353771f3f4dd797d0d6aae4c75b414ae8582f195b104a78420ca51925d5bf07e46d2d559b6f1b350535cc1372692bfb6629099eb92ad724d5a6fc6eba876c3dd0edf28a78b15d9807f43a034e490ba4528428b37c14b26f728d95d0c1e7679d304c7e9067e5a3cbf80254d540283c48a95b5c77196cfa9346cc17049034aa2861189d30baf5c3b4a38b7209d8706798b9b1ba580da60c2e6e73dca53960bc70f5a29445dc3b4dde3374201683391debb7a5199dba694c324ad23d5f4609270b67e0bfedb618eada82bd9d31f552526442979132cbdda683c7a612015ac408e66fb4a48a5522098f8b61fbdd32d04528b648b7a4f20cd8fb60baad6ebbd08c673144d401a0d2e9e1ba8f48709eb0aedb07ba8bfc2adaa8b322832f3e7ab1decf0f121e40202cbc1374b7c3d0457cfaa6a6363755eaee57b9aafe99a7e68160b28ab9df8fe8f34a7e9340b078967e778e092747fd5ff483ad61b894ccd96523843d55102362557001d87cf734a0ab41860bf5a57943dffebb619fcf44b43605e2ef5e9cbe28663928c284a6e4e044d173b25222dd21998258a44f057eb392e6e40f96620b6365b39e86ebed01fff8690f326ec76deb400c0dc4937f32e8cce508b757f41595c0f
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(234055);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-20141");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwf89955");
  script_xref(name:"CISCO-SA", value:"cisco-sa-xr792-bWfVDPY");
  script_xref(name:"IAVA", value:"2025-A-0159-S");

  script_name(english:"Cisco IOS XR Software Release 7.9.2 DoS (cisco-sa-xr792-bWfVDPY)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XR is affected by a vulnerability.

  - A vulnerability in the handling of specific packets that are punted from a line card to a route processor
    in Cisco IOS XR Software Release 7.9.2 could allow an unauthenticated, adjacent attacker to cause control
    plane traffic to stop working on multiple Cisco IOS XR platforms. This vulnerability is due to
    incorrect handling of packets that are punted to the route processor. An attacker could exploit this
    vulnerability by sending traffic, which must be handled by the Linux stack on the route processor, to an
    affected device. A successful exploit could allow the attacker to cause control plane traffic to stop
    working, resulting in a denial of service (DoS) condition. (CVE-2025-20141)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr792-bWfVDPY
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8571b2ec");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75548
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ecfccd38");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwf89955");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwf89955");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20141");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(770);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/03/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/04/09");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xr_version.nasl");
  script_require_keys("Host/Cisco/IOS-XR/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XR');

var model = toupper(product_info.model);

# Vulnerable model list
if ('IOSXRWBD' >!< model && ('NCS' >!< model && model !~ "5[4][0-9]{1}|5[57][0-9]{2}"))
    audit(AUDIT_HOST_NOT, 'an affected model');

var vuln_ranges = [
 {'min_ver': '7.9.2', 'fix_ver': '7.9.3'}
];

var reporting = make_array(
  'port'          , product_info['port'],
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwf89955',
  'fix'           , 'See vendor advisory',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);