CVE-2025-20221

A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters. This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by sending a crafted packet to the affected device. A successful exploit could allow the attacker to bypass the Layer 3 and Layer 4 traffic filters and inject a crafted packet into the network.

Published: 2025-05-07 Last update: 2025-07-11 Assigner: [email protected] Source: [email protected]
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2025-20221 is rated Low Risk (27/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.05%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2025-20221

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-01-21 0.01% 0.05% +0.04%
2 2025-05-08 — 0.01% —

Full EPSS history (2 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-20221

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.3 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 1.4 [email protected]
9.1 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 5.2 [email protected]

Weakness enumeration for CVE-2025-20221

Affected software / configurations for CVE-2025-20221

Vendor Product Version Raw CPE
cisco ios_xe 16.12.13 cpe:2.3:o:cisco:ios_xe:16.12.13:*:*:*:*:*:*:*
cisco ios_xe 17.1.1 cpe:2.3:o:cisco:ios_xe:17.1.1:*:*:*:*:*:*:*
cisco ios_xe 17.1.1s cpe:2.3:o:cisco:ios_xe:17.1.1s:*:*:*:*:*:*:*
cisco ios_xe 17.1.1t cpe:2.3:o:cisco:ios_xe:17.1.1t:*:*:*:*:*:*:*
cisco ios_xe 17.1.3 cpe:2.3:o:cisco:ios_xe:17.1.3:*:*:*:*:*:*:*
cisco ios_xe 17.2.1 cpe:2.3:o:cisco:ios_xe:17.2.1:*:*:*:*:*:*:*
cisco ios_xe 17.2.1a cpe:2.3:o:cisco:ios_xe:17.2.1a:*:*:*:*:*:*:*
cisco ios_xe 17.2.1r cpe:2.3:o:cisco:ios_xe:17.2.1r:*:*:*:*:*:*:*
cisco ios_xe 17.2.1v cpe:2.3:o:cisco:ios_xe:17.2.1v:*:*:*:*:*:*:*
cisco ios_xe 17.2.2 cpe:2.3:o:cisco:ios_xe:17.2.2:*:*:*:*:*:*:*
cisco ios_xe 17.2.3 cpe:2.3:o:cisco:ios_xe:17.2.3:*:*:*:*:*:*:*
cisco ios_xe 17.3.1 cpe:2.3:o:cisco:ios_xe:17.3.1:*:*:*:*:*:*:*
cisco ios_xe 17.3.1a cpe:2.3:o:cisco:ios_xe:17.3.1a:*:*:*:*:*:*:*
cisco ios_xe 17.3.2 cpe:2.3:o:cisco:ios_xe:17.3.2:*:*:*:*:*:*:*
cisco ios_xe 17.3.2a cpe:2.3:o:cisco:ios_xe:17.3.2a:*:*:*:*:*:*:*
cisco ios_xe 17.3.3 cpe:2.3:o:cisco:ios_xe:17.3.3:*:*:*:*:*:*:*
cisco ios_xe 17.3.4 cpe:2.3:o:cisco:ios_xe:17.3.4:*:*:*:*:*:*:*
cisco ios_xe 17.3.4a cpe:2.3:o:cisco:ios_xe:17.3.4a:*:*:*:*:*:*:*
cisco ios_xe 17.3.5 cpe:2.3:o:cisco:ios_xe:17.3.5:*:*:*:*:*:*:*
cisco ios_xe 17.3.6 cpe:2.3:o:cisco:ios_xe:17.3.6:*:*:*:*:*:*:*
cisco ios_xe 17.3.7 cpe:2.3:o:cisco:ios_xe:17.3.7:*:*:*:*:*:*:*
cisco ios_xe 17.3.8 cpe:2.3:o:cisco:ios_xe:17.3.8:*:*:*:*:*:*:*
cisco ios_xe 17.3.8a cpe:2.3:o:cisco:ios_xe:17.3.8a:*:*:*:*:*:*:*
cisco ios_xe 17.4.1 cpe:2.3:o:cisco:ios_xe:17.4.1:*:*:*:*:*:*:*
cisco ios_xe 17.4.1a cpe:2.3:o:cisco:ios_xe:17.4.1a:*:*:*:*:*:*:*
cisco ios_xe 17.4.1b cpe:2.3:o:cisco:ios_xe:17.4.1b:*:*:*:*:*:*:*
cisco ios_xe 17.4.2 cpe:2.3:o:cisco:ios_xe:17.4.2:*:*:*:*:*:*:*
cisco ios_xe 17.5.1 cpe:2.3:o:cisco:ios_xe:17.5.1:*:*:*:*:*:*:*
cisco ios_xe 17.5.1a cpe:2.3:o:cisco:ios_xe:17.5.1a:*:*:*:*:*:*:*
cisco ios_xe 17.6.1 cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*
cisco ios_xe 17.6.1a cpe:2.3:o:cisco:ios_xe:17.6.1a:*:*:*:*:*:*:*
cisco ios_xe 17.6.1y cpe:2.3:o:cisco:ios_xe:17.6.1y:*:*:*:*:*:*:*
cisco ios_xe 17.6.2 cpe:2.3:o:cisco:ios_xe:17.6.2:*:*:*:*:*:*:*
cisco ios_xe 17.6.3 cpe:2.3:o:cisco:ios_xe:17.6.3:*:*:*:*:*:*:*
cisco ios_xe 17.6.3a cpe:2.3:o:cisco:ios_xe:17.6.3a:*:*:*:*:*:*:*
cisco ios_xe 17.6.4 cpe:2.3:o:cisco:ios_xe:17.6.4:*:*:*:*:*:*:*
cisco ios_xe 17.6.5 cpe:2.3:o:cisco:ios_xe:17.6.5:*:*:*:*:*:*:*
cisco ios_xe 17.6.5a cpe:2.3:o:cisco:ios_xe:17.6.5a:*:*:*:*:*:*:*
cisco ios_xe 17.6.6 cpe:2.3:o:cisco:ios_xe:17.6.6:*:*:*:*:*:*:*
cisco ios_xe 17.6.6a cpe:2.3:o:cisco:ios_xe:17.6.6a:*:*:*:*:*:*:*
cisco ios_xe 17.6.7 cpe:2.3:o:cisco:ios_xe:17.6.7:*:*:*:*:*:*:*
cisco ios_xe 17.6.8 cpe:2.3:o:cisco:ios_xe:17.6.8:*:*:*:*:*:*:*
cisco ios_xe 17.6.8a cpe:2.3:o:cisco:ios_xe:17.6.8a:*:*:*:*:*:*:*
cisco ios_xe 17.7.1 cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:*
cisco ios_xe 17.7.1a cpe:2.3:o:cisco:ios_xe:17.7.1a:*:*:*:*:*:*:*
cisco ios_xe 17.7.2 cpe:2.3:o:cisco:ios_xe:17.7.2:*:*:*:*:*:*:*
cisco ios_xe 17.8.1 cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:*
cisco ios_xe 17.8.1a cpe:2.3:o:cisco:ios_xe:17.8.1a:*:*:*:*:*:*:*
cisco ios_xe 17.9.1 cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*
cisco ios_xe 17.9.1a cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*
cisco ios_xe 17.9.2 cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*
cisco ios_xe 17.9.2a cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*
cisco ios_xe 17.9.3 cpe:2.3:o:cisco:ios_xe:17.9.3:*:*:*:*:*:*:*
cisco ios_xe 17.9.3a cpe:2.3:o:cisco:ios_xe:17.9.3a:*:*:*:*:*:*:*
cisco ios_xe 17.9.4 cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*
cisco ios_xe 17.9.4a cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*
cisco ios_xe 17.9.5 cpe:2.3:o:cisco:ios_xe:17.9.5:*:*:*:*:*:*:*
cisco ios_xe 17.9.5a cpe:2.3:o:cisco:ios_xe:17.9.5a:*:*:*:*:*:*:*
cisco ios_xe 17.9.5b cpe:2.3:o:cisco:ios_xe:17.9.5b:*:*:*:*:*:*:*
cisco ios_xe 17.9.5e cpe:2.3:o:cisco:ios_xe:17.9.5e:*:*:*:*:*:*:*
cisco ios_xe 17.9.5f cpe:2.3:o:cisco:ios_xe:17.9.5f:*:*:*:*:*:*:*
cisco ios_xe 17.9.6 cpe:2.3:o:cisco:ios_xe:17.9.6:*:*:*:*:*:*:*
cisco ios_xe 17.9.6a cpe:2.3:o:cisco:ios_xe:17.9.6a:*:*:*:*:*:*:*
cisco ios_xe 17.10.1 cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*
cisco ios_xe 17.10.1a cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*
cisco ios_xe 17.10.1b cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*
cisco ios_xe 17.11.1 cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*
cisco ios_xe 17.11.1a cpe:2.3:o:cisco:ios_xe:17.11.1a:*:*:*:*:*:*:*
cisco ios_xe 17.12.1 cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*
cisco ios_xe 17.12.1a cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*
cisco ios_xe 17.12.1z2 cpe:2.3:o:cisco:ios_xe:17.12.1z2:*:*:*:*:*:*:*
cisco ios_xe 17.12.2 cpe:2.3:o:cisco:ios_xe:17.12.2:*:*:*:*:*:*:*
cisco ios_xe 17.12.3 cpe:2.3:o:cisco:ios_xe:17.12.3:*:*:*:*:*:*:*
cisco ios_xe 17.12.3a cpe:2.3:o:cisco:ios_xe:17.12.3a:*:*:*:*:*:*:*
cisco ios_xe 17.12.4 cpe:2.3:o:cisco:ios_xe:17.12.4:*:*:*:*:*:*:*
cisco ios_xe 17.12.4a cpe:2.3:o:cisco:ios_xe:17.12.4a:*:*:*:*:*:*:*
cisco ios_xe 17.12.4b cpe:2.3:o:cisco:ios_xe:17.12.4b:*:*:*:*:*:*:*
cisco ios_xe 17.13.1 cpe:2.3:o:cisco:ios_xe:17.13.1:*:*:*:*:*:*:*
cisco ios_xe 17.13.1a cpe:2.3:o:cisco:ios_xe:17.13.1a:*:*:*:*:*:*:*
cisco ios_xe 17.14.1 cpe:2.3:o:cisco:ios_xe:17.14.1:*:*:*:*:*:*:*

References for CVE-2025-20221

cvelogic Threat Intelligence