CVE-2025-20209: Cisco IOS XR Software Internet Key Exchange Version 2 Denial of Service Vulnerability
First published: Wed Mar 12 2025(Updated: )
A vulnerability in the Internet Key Exchange version 2 (IKEv2) function of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent an affected device from processing any control plane UDP packets. This vulnerability is due to improper handling of malformed IKEv2 packets. An attacker could exploit this vulnerability by sending malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to prevent the affected device from processing any control plane UDP packets, resulting in a denial of service (DoS) condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XRv 9000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-20209?
CVE-2025-20209 is classified as a high severity vulnerability due to its potential to disrupt critical control plane functionality.
How do I fix CVE-2025-20209?
To mitigate CVE-2025-20209, upgrade your Cisco IOS XR Software to the recommended patched version provided by Cisco.
Who is affected by CVE-2025-20209?
CVE-2025-20209 affects devices running Cisco IOS XR Software, specifically impacting their IKEv2 functionality.
What kind of attack can exploit CVE-2025-20209?
CVE-2025-20209 can be exploited by unauthenticated remote attackers to prevent the processing of UDP control plane packets.
When was CVE-2025-20209 reported?
CVE-2025-20209 was reported in 2025 and highlights a critical issue within the IKEv2 implementation in Cisco IOS XR Software.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/source
- agent/author
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/cisco
- canonical/cisco ios xrv 9000