CVE-2025-20137
First published: Wed May 07 2025(Updated: )
A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Switches could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the use of both an IPv4 ACL and a dynamic ACL of IP Source Guard on the same interface, which is an unsupported configuration. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device. Note: Cisco documentation has been updated to reflect that this is an unsupported configuration. However, Cisco is publishing this advisory because the device will not prevent an administrator from configuring both features on the same interface. There are no plans to implement the ability to configure both features on the same interface on Cisco Catalyst 1000 or Catalyst 2960L Switches.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco Catalyst 1000 Switches | ||
| Cisco Catalyst 2960L Switches |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-20137?
CVE-2025-20137 is classified as a critical vulnerability that can allow unauthenticated remote attackers to bypass access control lists.
How do I fix CVE-2025-20137?
To remediate CVE-2025-20137, ensure that your Cisco IOS Software and Catalyst switch firmware are updated to the latest versions provided by Cisco.
Which devices are affected by CVE-2025-20137?
CVE-2025-20137 affects Cisco IOS Software, Cisco Catalyst 1000 Switches, and Cisco Catalyst 2960L Switches.
Can CVE-2025-20137 be exploited remotely?
Yes, CVE-2025-20137 allows for remote exploitation by an unauthenticated attacker.
What type of vulnerability is CVE-2025-20137?
CVE-2025-20137 is an access control vulnerability resulting from misconfigurations in ACL programming.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/cisco
- canonical/cisco ios
- canonical/cisco catalyst 1000 switches
- canonical/cisco catalyst 2960l switches