Cisco IOS XR Software Image Verification Bypass Vulnerability (CVE-2025-20248)

CVE number = CVE-2025-20248

A vulnerability in the installation process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR Software image signature verification and load unsigned software on an affected device.

To exploit this vulnerability, the attacker must have root-system privileges on the affected device.

This vulnerability is due to incomplete validation of files during the installation of an .iso file. An attacker could exploit this vulnerability by modifying contents of the .iso image and then installing and activating it on the device.

A successful exploit could allow the attacker to load an unsigned file as part of the image activation process.

Note: Because exploitation of this vulnerability could result in the attacker bypassing Cisco image verification, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco IOS XR Software, regardless of device configuration:

NCS 6000 Series Routers

ASR 9000 Series Aggregation Services Routers (64-bit)

IOS XR White box (IOSXRWBD)

IOS XRv 9000 Routers

Network Convergence System (NCS) 540 Series Routers that are running an NCS 540-iosxr base image

NCS 560 Series Routers

NCS 1000 Series (NCS 1001, NCS 1002, and NCS 1004)

NCS 5000 Series Routers

NCS 5500 Series Routers

NCS 5700 Series Line Cards and Routers that are running an NCS 5500 base image

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrsig-UY4zRUCG