CVE-2025-20189 [High] | Denial of Service in Ios Xe

A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper memory management when Cisco IOS XE Software is processing Address Resolution Protocol (ARP) messages. An attacker could exploit this vulnerability by sending crafted ARP messages at a high rate over a period of time to an affected device. A successful exploit could allow the attacker to exhaust system resources, which eventually triggers a reload of the active route switch processor (RSP). If a redundant RSP is not present, the router reloads.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.10%	0.20%	+0.10%
2	2026-03-03	0.01%	0.10%	+0.09%
3	2025-05-08	—	0.01%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.10%

0.20%

+0.10%

2026-03-03

0.01%

0.10%

+0.09%

2025-05-08

—

0.01%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.4	3.1	HIGH	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	2.8	4.0	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.4

3.1

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

2.8

4.0

[email protected]

Affected software / configurations for CVE-2025-20189

Vendor	Product	Version	Raw CPE
cisco	ios_xe	3.16.0cs	cpe:2.3:o:cisco:ios_xe:3.16.0cs:::::::*
cisco	ios_xe	3.16.0s	cpe:2.3:o:cisco:ios_xe:3.16.0s:::::::*
cisco	ios_xe	3.16.1as	cpe:2.3:o:cisco:ios_xe:3.16.1as:::::::*
cisco	ios_xe	3.16.1s	cpe:2.3:o:cisco:ios_xe:3.16.1s:::::::*
cisco	ios_xe	3.16.2as	cpe:2.3:o:cisco:ios_xe:3.16.2as:::::::*
cisco	ios_xe	3.16.2bs	cpe:2.3:o:cisco:ios_xe:3.16.2bs:::::::*
cisco	ios_xe	3.16.2s	cpe:2.3:o:cisco:ios_xe:3.16.2s:::::::*
cisco	ios_xe	3.16.3as	cpe:2.3:o:cisco:ios_xe:3.16.3as:::::::*
cisco	ios_xe	3.16.3s	cpe:2.3:o:cisco:ios_xe:3.16.3s:::::::*
cisco	ios_xe	3.16.4as	cpe:2.3:o:cisco:ios_xe:3.16.4as:::::::*
cisco	ios_xe	3.16.4bs	cpe:2.3:o:cisco:ios_xe:3.16.4bs:::::::*
cisco	ios_xe	3.16.4ds	cpe:2.3:o:cisco:ios_xe:3.16.4ds:::::::*
cisco	ios_xe	3.16.4s	cpe:2.3:o:cisco:ios_xe:3.16.4s:::::::*
cisco	ios_xe	3.16.5s	cpe:2.3:o:cisco:ios_xe:3.16.5s:::::::*
cisco	ios_xe	3.16.6bs	cpe:2.3:o:cisco:ios_xe:3.16.6bs:::::::*
cisco	ios_xe	3.16.6s	cpe:2.3:o:cisco:ios_xe:3.16.6s:::::::*
cisco	ios_xe	3.16.7as	cpe:2.3:o:cisco:ios_xe:3.16.7as:::::::*
cisco	ios_xe	3.16.7bs	cpe:2.3:o:cisco:ios_xe:3.16.7bs:::::::*
cisco	ios_xe	3.16.7s	cpe:2.3:o:cisco:ios_xe:3.16.7s:::::::*
cisco	ios_xe	3.16.8s	cpe:2.3:o:cisco:ios_xe:3.16.8s:::::::*
cisco	ios_xe	3.16.9s	cpe:2.3:o:cisco:ios_xe:3.16.9s:::::::*
cisco	ios_xe	3.16.10s	cpe:2.3:o:cisco:ios_xe:3.16.10s:::::::*
cisco	ios_xe	3.17.0s	cpe:2.3:o:cisco:ios_xe:3.17.0s:::::::*
cisco	ios_xe	3.17.1as	cpe:2.3:o:cisco:ios_xe:3.17.1as:::::::*
cisco	ios_xe	3.17.1s	cpe:2.3:o:cisco:ios_xe:3.17.1s:::::::*
cisco	ios_xe	3.17.2s	cpe:2.3:o:cisco:ios_xe:3.17.2s:::::::*
cisco	ios_xe	3.17.3s	cpe:2.3:o:cisco:ios_xe:3.17.3s:::::::*
cisco	ios_xe	3.17.4s	cpe:2.3:o:cisco:ios_xe:3.17.4s:::::::*
cisco	ios_xe	3.18.0as	cpe:2.3:o:cisco:ios_xe:3.18.0as:::::::*
cisco	ios_xe	3.18.0s	cpe:2.3:o:cisco:ios_xe:3.18.0s:::::::*
cisco	ios_xe	3.18.0sp	cpe:2.3:o:cisco:ios_xe:3.18.0sp:::::::*
cisco	ios_xe	3.18.1asp	cpe:2.3:o:cisco:ios_xe:3.18.1asp:::::::*
cisco	ios_xe	3.18.1bsp	cpe:2.3:o:cisco:ios_xe:3.18.1bsp:::::::*
cisco	ios_xe	3.18.1csp	cpe:2.3:o:cisco:ios_xe:3.18.1csp:::::::*
cisco	ios_xe	3.18.1s	cpe:2.3:o:cisco:ios_xe:3.18.1s:::::::*
cisco	ios_xe	3.18.1sp	cpe:2.3:o:cisco:ios_xe:3.18.1sp:::::::*
cisco	ios_xe	3.18.2asp	cpe:2.3:o:cisco:ios_xe:3.18.2asp:::::::*
cisco	ios_xe	3.18.2s	cpe:2.3:o:cisco:ios_xe:3.18.2s:::::::*
cisco	ios_xe	3.18.2sp	cpe:2.3:o:cisco:ios_xe:3.18.2sp:::::::*
cisco	ios_xe	3.18.3asp	cpe:2.3:o:cisco:ios_xe:3.18.3asp:::::::*
cisco	ios_xe	3.18.3bsp	cpe:2.3:o:cisco:ios_xe:3.18.3bsp:::::::*
cisco	ios_xe	3.18.3s	cpe:2.3:o:cisco:ios_xe:3.18.3s:::::::*
cisco	ios_xe	3.18.3sp	cpe:2.3:o:cisco:ios_xe:3.18.3sp:::::::*
cisco	ios_xe	3.18.4s	cpe:2.3:o:cisco:ios_xe:3.18.4s:::::::*
cisco	ios_xe	3.18.4sp	cpe:2.3:o:cisco:ios_xe:3.18.4sp:::::::*
cisco	ios_xe	3.18.5sp	cpe:2.3:o:cisco:ios_xe:3.18.5sp:::::::*
cisco	ios_xe	3.18.6sp	cpe:2.3:o:cisco:ios_xe:3.18.6sp:::::::*
cisco	ios_xe	3.18.7sp	cpe:2.3:o:cisco:ios_xe:3.18.7sp:::::::*
cisco	ios_xe	3.18.8asp	cpe:2.3:o:cisco:ios_xe:3.18.8asp:::::::*
cisco	ios_xe	3.18.9sp	cpe:2.3:o:cisco:ios_xe:3.18.9sp:::::::*
cisco	ios_xe	16.1.1	cpe:2.3:o:cisco:ios_xe:16.1.1:::::::*
cisco	ios_xe	16.1.2	cpe:2.3:o:cisco:ios_xe:16.1.2:::::::*
cisco	ios_xe	16.1.3	cpe:2.3:o:cisco:ios_xe:16.1.3:::::::*
cisco	ios_xe	16.2.1	cpe:2.3:o:cisco:ios_xe:16.2.1:::::::*
cisco	ios_xe	16.2.2	cpe:2.3:o:cisco:ios_xe:16.2.2:::::::*
cisco	ios_xe	16.3.1	cpe:2.3:o:cisco:ios_xe:16.3.1:::::::*
cisco	ios_xe	16.3.1a	cpe:2.3:o:cisco:ios_xe:16.3.1a:::::::*
cisco	ios_xe	16.3.2	cpe:2.3:o:cisco:ios_xe:16.3.2:::::::*
cisco	ios_xe	16.3.3	cpe:2.3:o:cisco:ios_xe:16.3.3:::::::*
cisco	ios_xe	16.3.4	cpe:2.3:o:cisco:ios_xe:16.3.4:::::::*
cisco	ios_xe	16.3.5	cpe:2.3:o:cisco:ios_xe:16.3.5:::::::*
cisco	ios_xe	16.3.5b	cpe:2.3:o:cisco:ios_xe:16.3.5b:::::::*
cisco	ios_xe	16.3.6	cpe:2.3:o:cisco:ios_xe:16.3.6:::::::*
cisco	ios_xe	16.3.7	cpe:2.3:o:cisco:ios_xe:16.3.7:::::::*
cisco	ios_xe	16.3.8	cpe:2.3:o:cisco:ios_xe:16.3.8:::::::*
cisco	ios_xe	16.3.9	cpe:2.3:o:cisco:ios_xe:16.3.9:::::::*
cisco	ios_xe	16.3.10	cpe:2.3:o:cisco:ios_xe:16.3.10:::::::*
cisco	ios_xe	16.3.11	cpe:2.3:o:cisco:ios_xe:16.3.11:::::::*
cisco	ios_xe	16.4.1	cpe:2.3:o:cisco:ios_xe:16.4.1:::::::*
cisco	ios_xe	16.4.2	cpe:2.3:o:cisco:ios_xe:16.4.2:::::::*
cisco	ios_xe	16.4.3	cpe:2.3:o:cisco:ios_xe:16.4.3:::::::*
cisco	ios_xe	16.5.1	cpe:2.3:o:cisco:ios_xe:16.5.1:::::::*
cisco	ios_xe	16.5.1a	cpe:2.3:o:cisco:ios_xe:16.5.1a:::::::*
cisco	ios_xe	16.5.1b	cpe:2.3:o:cisco:ios_xe:16.5.1b:::::::*
cisco	ios_xe	16.5.2	cpe:2.3:o:cisco:ios_xe:16.5.2:::::::*
cisco	ios_xe	16.5.3	cpe:2.3:o:cisco:ios_xe:16.5.3:::::::*
cisco	ios_xe	16.6.1	cpe:2.3:o:cisco:ios_xe:16.6.1:::::::*
cisco	ios_xe	16.6.2	cpe:2.3:o:cisco:ios_xe:16.6.2:::::::*
cisco	ios_xe	16.6.3	cpe:2.3:o:cisco:ios_xe:16.6.3:::::::*
cisco	ios_xe	16.6.4	cpe:2.3:o:cisco:ios_xe:16.6.4:::::::*

References for CVE-2025-20189

URL	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ	Vendor Advisory

URL

CVE-2025-20189

Exploit prediction scoring system (EPSS) score for CVE-2025-20189

Common vulnerability scoring system (CVSS) metrics for CVE-2025-20189

Weakness enumeration for CVE-2025-20189

Affected software / configurations for CVE-2025-20189

References for CVE-2025-20189