Vulnerability-Lookup

BDU:2025-10321

Vulnerability from fstec - Published: 07.05.2025

Title

Уязвимость механизма списка контроля доступа ACL операционной системы Cisco IOS, позволяющая нарушителю обойти существующие ограничения безопасности

Description

Уязвимость механизма списка контроля доступа ACL операционной системы Cisco IOS связана с ошибками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти существующие ограничения безопасности

Severity ?


                    
                      AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Vendor

Cisco Systems Inc.

Software Name

Cisco IOS, Catalyst 1000 Switches, Catalyst 2960-L Series Switches

Software Version

15.2(6)E (Cisco IOS), 15.2(6)E0c (Cisco IOS), 15.2(5a)E (Cisco IOS), 15.2(5b)E (Cisco IOS), 15.2(5c)E (Cisco IOS), 15.2(7)E (Cisco IOS), 12.2(6)I1 (Cisco IOS), 15.2(6)E1 (Cisco IOS), 15.2(6)E1a (Cisco IOS), 15.2(6)E1s (Cisco IOS), 15.1(3)SVR1 (Cisco IOS), 15.1(3)SVR2 (Cisco IOS), 15.1(3)SVR3 (Cisco IOS), 15.1(3)SVS (Cisco IOS), 15.1(3)SVS1 (Cisco IOS), 15.1(3)SVT1 (Cisco IOS), 15.1(3)SVT2 (Cisco IOS), 15.1(3)SVU1 (Cisco IOS), 15.2(6)E2 (Cisco IOS), 15.2(6)E2b (Cisco IOS), 15.2(6)E3 (Cisco IOS), 15.2(7)E0a (Cisco IOS), 15.2(7)E0s (Cisco IOS), 15.2(7)E1 (Cisco IOS), 15.2(7)E1a (Cisco IOS), 15.2(7)E2 (Cisco IOS), 15.2(7)E3 (Cisco IOS), 15.2(7)E3k (Cisco IOS), 15.2(7)E5 (Cisco IOS), 15.2(7a)E0b (Cisco IOS), 15.2(7b)E0b (Cisco IOS), 15.2(8)E (Cisco IOS), 15.2(8)E1 (Cisco IOS), 15.2(7)E4 (Cisco IOS), 15.2(7)E6 (Cisco IOS), 15.2(8)E2 (Cisco IOS), 15.2(7)E7 (Cisco IOS), 15.2(8)E3 (Cisco IOS), 15.2(7)E8 (Cisco IOS), 15.2(8)E4 (Cisco IOS), 15.1(3)SVX (Cisco IOS), 15.1(3)SVX1 (Cisco IOS), 15.1(3)SVW (Cisco IOS), 15.1(3)SVW1 (Cisco IOS), 15.1(3)SVV1 (Cisco IOS), 15.1(3)SVV2 (Cisco IOS), 15.1(3)SVV3 (Cisco IOS), 15.1(3)SVV4 (Cisco IOS), 15.1(3)SVU10 (Cisco IOS), 15.1(3)SVU2 (Cisco IOS), 15.1(3)SVU11 (Cisco IOS), 15.1(3)SVU20 (Cisco IOS), 15.1(3)SVU21 (Cisco IOS), 15.1(3)SVT3 (Cisco IOS), 15.1(3)SVT4 (Cisco IOS), 15.1(3)SVR10 (Cisco IOS), 15.2(7)E9 (Cisco IOS), 15.2(8)E5 (Cisco IOS), 15.2(7)E10 (Cisco IOS), 15.2(8)E6 (Cisco IOS), 15.2(7)E11 (Cisco IOS), - (Catalyst 1000 Switches), - (Catalyst 2960-L Series Switches), 15.2(7)E12 (Cisco IOS), 15.2(8)E8 (Cisco IOS)

Possible Mitigations

Использование рекомендаций: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsgacl-pg6qfZk

Reference

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsgacl-pg6qfZk

CWE

CWE-284

JSON

To clipboard

{
  "CVSS 2.0": "AV:A/AC:L/Au:N/C:N/I:P/A:N",
  "CVSS 3.0": "AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Cisco Systems Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "15.2(6)E (Cisco IOS), 15.2(6)E0c (Cisco IOS), 15.2(5a)E (Cisco IOS), 15.2(5b)E (Cisco IOS), 15.2(5c)E (Cisco IOS), 15.2(7)E (Cisco IOS), 12.2(6)I1 (Cisco IOS), 15.2(6)E1 (Cisco IOS), 15.2(6)E1a (Cisco IOS), 15.2(6)E1s (Cisco IOS), 15.1(3)SVR1 (Cisco IOS), 15.1(3)SVR2 (Cisco IOS), 15.1(3)SVR3 (Cisco IOS), 15.1(3)SVS (Cisco IOS), 15.1(3)SVS1 (Cisco IOS), 15.1(3)SVT1 (Cisco IOS), 15.1(3)SVT2 (Cisco IOS), 15.1(3)SVU1 (Cisco IOS), 15.2(6)E2 (Cisco IOS), 15.2(6)E2b (Cisco IOS), 15.2(6)E3 (Cisco IOS), 15.2(7)E0a (Cisco IOS), 15.2(7)E0s (Cisco IOS), 15.2(7)E1 (Cisco IOS), 15.2(7)E1a (Cisco IOS), 15.2(7)E2 (Cisco IOS), 15.2(7)E3 (Cisco IOS), 15.2(7)E3k (Cisco IOS), 15.2(7)E5 (Cisco IOS), 15.2(7a)E0b (Cisco IOS), 15.2(7b)E0b (Cisco IOS), 15.2(8)E (Cisco IOS), 15.2(8)E1 (Cisco IOS), 15.2(7)E4 (Cisco IOS), 15.2(7)E6 (Cisco IOS), 15.2(8)E2 (Cisco IOS), 15.2(7)E7 (Cisco IOS), 15.2(8)E3 (Cisco IOS), 15.2(7)E8 (Cisco IOS), 15.2(8)E4 (Cisco IOS), 15.1(3)SVX (Cisco IOS), 15.1(3)SVX1 (Cisco IOS), 15.1(3)SVW (Cisco IOS), 15.1(3)SVW1 (Cisco IOS), 15.1(3)SVV1 (Cisco IOS), 15.1(3)SVV2 (Cisco IOS), 15.1(3)SVV3 (Cisco IOS), 15.1(3)SVV4 (Cisco IOS), 15.1(3)SVU10 (Cisco IOS), 15.1(3)SVU2 (Cisco IOS), 15.1(3)SVU11 (Cisco IOS), 15.1(3)SVU20 (Cisco IOS), 15.1(3)SVU21 (Cisco IOS), 15.1(3)SVT3 (Cisco IOS), 15.1(3)SVT4 (Cisco IOS), 15.1(3)SVR10 (Cisco IOS), 15.2(7)E9 (Cisco IOS), 15.2(8)E5 (Cisco IOS), 15.2(7)E10 (Cisco IOS), 15.2(8)E6 (Cisco IOS), 15.2(7)E11 (Cisco IOS), - (Catalyst 1000 Switches), - (Catalyst 2960-L Series Switches), 15.2(7)E12 (Cisco IOS), 15.2(8)E8 (Cisco IOS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsgacl-pg6qfZk",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "07.05.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "27.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "27.08.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-10321",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-20137",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Cisco IOS, Catalyst 1000 Switches, Catalyst 2960-L Series Switches",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Cisco Systems Inc. Cisco IOS 15.2(6)E , Cisco Systems Inc. Cisco IOS 15.2(6)E0c , Cisco Systems Inc. Cisco IOS 15.2(5a)E , Cisco Systems Inc. Cisco IOS 15.2(5b)E , Cisco Systems Inc. Cisco IOS 15.2(5c)E , Cisco Systems Inc. Cisco IOS 15.2(7)E , Cisco Systems Inc. Cisco IOS 12.2(6)I1 , Cisco Systems Inc. Cisco IOS 15.2(6)E1 , Cisco Systems Inc. Cisco IOS 15.2(6)E1a , Cisco Systems Inc. Cisco IOS 15.2(6)E1s , Cisco Systems Inc. Cisco IOS 15.1(3)SVR1 , Cisco Systems Inc. Cisco IOS 15.1(3)SVR2 , Cisco Systems Inc. Cisco IOS 15.1(3)SVR3 , Cisco Systems Inc. Cisco IOS 15.1(3)SVS , Cisco Systems Inc. Cisco IOS 15.1(3)SVS1 , Cisco Systems Inc. Cisco IOS 15.1(3)SVT1 , Cisco Systems Inc. Cisco IOS 15.1(3)SVT2 , Cisco Systems Inc. Cisco IOS 15.1(3)SVU1 , Cisco Systems Inc. Cisco IOS 15.2(6)E2 , Cisco Systems Inc. Cisco IOS 15.2(6)E2b , Cisco Systems Inc. Cisco IOS 15.2(6)E3 , Cisco Systems Inc. Cisco IOS 15.2(7)E0a , Cisco Systems Inc. Cisco IOS 15.2(7)E0s , Cisco Systems Inc. Cisco IOS 15.2(7)E1 , Cisco Systems Inc. Cisco IOS 15.2(7)E1a , Cisco Systems Inc. Cisco IOS 15.2(7)E2 , Cisco Systems Inc. Cisco IOS 15.2(7)E3 , Cisco Systems Inc. Cisco IOS 15.2(7)E3k , Cisco Systems Inc. Cisco IOS 15.2(7)E5 , Cisco Systems Inc. Cisco IOS 15.2(7a)E0b , Cisco Systems Inc. Cisco IOS 15.2(7b)E0b , Cisco Systems Inc. Cisco IOS 15.2(8)E , Cisco Systems Inc. Cisco IOS 15.2(8)E1 , Cisco Systems Inc. Cisco IOS 15.2(7)E4 , Cisco Systems Inc. Cisco IOS 15.2(7)E6 , Cisco Systems Inc. Cisco IOS 15.2(8)E2 , Cisco Systems Inc. Cisco IOS 15.2(7)E7 , Cisco Systems Inc. Cisco IOS 15.2(8)E3 , Cisco Systems Inc. Cisco IOS 15.2(7)E8 , Cisco Systems Inc. Cisco IOS 15.2(8)E4 , Cisco Systems Inc. Cisco IOS 15.1(3)SVX , Cisco Systems Inc. Cisco IOS 15.1(3)SVX1 , Cisco Systems Inc. Cisco IOS 15.1(3)SVW , Cisco Systems Inc. Cisco IOS 15.1(3)SVW1 , Cisco Systems Inc. Cisco IOS 15.1(3)SVV1 , Cisco Systems Inc. Cisco IOS 15.1(3)SVV2 , Cisco Systems Inc. Cisco IOS 15.1(3)SVV3 , Cisco Systems Inc. Cisco IOS 15.1(3)SVV4 , Cisco Systems Inc. Cisco IOS 15.1(3)SVU10 , Cisco Systems Inc. Cisco IOS 15.1(3)SVU2 , Cisco Systems Inc. Cisco IOS 15.1(3)SVU11 , Cisco Systems Inc. Cisco IOS 15.1(3)SVU20 , Cisco Systems Inc. Cisco IOS 15.1(3)SVU21 , Cisco Systems Inc. Cisco IOS 15.1(3)SVT3 , Cisco Systems Inc. Cisco IOS 15.1(3)SVT4 , Cisco Systems Inc. Cisco IOS 15.1(3)SVR10 , Cisco Systems Inc. Cisco IOS 15.2(7)E9 , Cisco Systems Inc. Cisco IOS 15.2(8)E5 , Cisco Systems Inc. Cisco IOS 15.2(7)E10 , Cisco Systems Inc. Cisco IOS 15.2(8)E6 , Cisco Systems Inc. Cisco IOS 15.2(7)E11 , Cisco Systems Inc. Cisco IOS 15.2(7)E12 , Cisco Systems Inc. Cisco IOS 15.2(8)E8 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0441\u043f\u0438\u0441\u043a\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 ACL \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Cisco IOS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (CWE-284)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0441\u043f\u0438\u0441\u043a\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 ACL \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Cisco IOS \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsgacl-pg6qfZk",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-284",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 3,3)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,7)"
}

CVE-2025-20137 (GCVE-0-2025-20137)

Vulnerability from cvelistv5 – Published: 2025-05-07 17:31 – Updated: 2025-05-07 19:45

Summary

A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Switches could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the use of both an IPv4 ACL and a dynamic ACL of IP Source Guard on the same interface, which is an unsupported configuration. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device. Note: Cisco documentation has been updated to reflect that this is an unsupported configuration. However, Cisco is publishing this advisory because the device will not prevent an administrator from configuring both features on the same interface. There are no plans to implement the ability to configure both features on the same interface on Cisco Catalyst 1000 or Catalyst 2960L Switches.

Severity ?

4.7 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

CWE

CWE-284 - Improper Access Control

Assigner

cisco

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

	Vendor	Product	Version
	Cisco	IOS	Affected: 15.2(5a)E Affected: 15.2(5b)E Affected: 15.2(5c)E Affected: 15.2(6)E Affected: 15.2(6)E1 Affected: 15.2(6)E0c Affected: 15.2(6)E2 Affected: 15.2(7)E Affected: 15.2(6)E2b Affected: 15.2(7)E1 Affected: 15.2(7)E0a Affected: 15.2(7)E0s Affected: 15.2(6)E3 Affected: 15.2(7)E2 Affected: 15.2(7a)E0b Affected: 15.2(7)E3 Affected: 15.2(7)E1a Affected: 15.2(7b)E0b Affected: 15.2(7)E4 Affected: 15.2(7)E3k Affected: 15.2(8)E Affected: 15.2(8)E1 Affected: 15.2(7)E5 Affected: 15.2(7)E6 Affected: 15.2(8)E2 Affected: 15.2(7)E7 Affected: 15.2(8)E3 Affected: 15.2(7)E8 Affected: 15.2(8)E4 Affected: 15.2(7)E9 Affected: 15.2(8)E5 Affected: 15.2(8)E6 Affected: 15.2(7)E10 Affected: 15.2(7)E11 Affected: 15.2(7)E12

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20137",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T18:56:17.944241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T19:45:55.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "IOS",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "15.2(5a)E"
            },
            {
              "status": "affected",
              "version": "15.2(5b)E"
            },
            {
              "status": "affected",
              "version": "15.2(5c)E"
            },
            {
              "status": "affected",
              "version": "15.2(6)E"
            },
            {
              "status": "affected",
              "version": "15.2(6)E1"
            },
            {
              "status": "affected",
              "version": "15.2(6)E0c"
            },
            {
              "status": "affected",
              "version": "15.2(6)E2"
            },
            {
              "status": "affected",
              "version": "15.2(7)E"
            },
            {
              "status": "affected",
              "version": "15.2(6)E2b"
            },
            {
              "status": "affected",
              "version": "15.2(7)E1"
            },
            {
              "status": "affected",
              "version": "15.2(7)E0a"
            },
            {
              "status": "affected",
              "version": "15.2(7)E0s"
            },
            {
              "status": "affected",
              "version": "15.2(6)E3"
            },
            {
              "status": "affected",
              "version": "15.2(7)E2"
            },
            {
              "status": "affected",
              "version": "15.2(7a)E0b"
            },
            {
              "status": "affected",
              "version": "15.2(7)E3"
            },
            {
              "status": "affected",
              "version": "15.2(7)E1a"
            },
            {
              "status": "affected",
              "version": "15.2(7b)E0b"
            },
            {
              "status": "affected",
              "version": "15.2(7)E4"
            },
            {
              "status": "affected",
              "version": "15.2(7)E3k"
            },
            {
              "status": "affected",
              "version": "15.2(8)E"
            },
            {
              "status": "affected",
              "version": "15.2(8)E1"
            },
            {
              "status": "affected",
              "version": "15.2(7)E5"
            },
            {
              "status": "affected",
              "version": "15.2(7)E6"
            },
            {
              "status": "affected",
              "version": "15.2(8)E2"
            },
            {
              "status": "affected",
              "version": "15.2(7)E7"
            },
            {
              "status": "affected",
              "version": "15.2(8)E3"
            },
            {
              "status": "affected",
              "version": "15.2(7)E8"
            },
            {
              "status": "affected",
              "version": "15.2(8)E4"
            },
            {
              "status": "affected",
              "version": "15.2(7)E9"
            },
            {
              "status": "affected",
              "version": "15.2(8)E5"
            },
            {
              "status": "affected",
              "version": "15.2(8)E6"
            },
            {
              "status": "affected",
              "version": "15.2(7)E10"
            },
            {
              "status": "affected",
              "version": "15.2(7)E11"
            },
            {
              "status": "affected",
              "version": "15.2(7)E12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Switches could allow an unauthenticated, remote attacker to bypass a configured ACL.\r\n\r This vulnerability is due to the use of both an IPv4 ACL and a dynamic ACL of IP Source Guard on the same interface, which is an unsupported configuration. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.\r\n\r Note: Cisco documentation has been updated to reflect that this is an unsupported configuration. However, Cisco is publishing this advisory because the device will not prevent an administrator from configuring both features on the same interface. There are no plans to implement the ability to configure both features on the same interface on Cisco Catalyst 1000 or Catalyst 2960L Switches."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Control",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-07T17:31:45.590Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ipsgacl-pg6qfZk",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsgacl-pg6qfZk"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ipsgacl-pg6qfZk",
        "defects": [
          "CSCwm03838"
        ],
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20137",
    "datePublished": "2025-05-07T17:31:45.590Z",
    "dateReserved": "2024-10-10T19:15:13.213Z",
    "dateUpdated": "2025-05-07T19:45:55.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2025-10321

CVE-2025-20137 (GCVE-0-2025-20137)

Tags

Sightings

Nomenclature