Cisco has addressed a high-severity denial of service (DoS) vulnerability (CVE-2025-20115) that could allow attackers to crash the Border Gateway Protocol (BGP) process on IOS XR routers using a single update message.

## Vulnerability Details

The flaw affects Cisco’s carrier-grade routers running IOS XR, including the Network Convergence System (NCS), Carrier Routing System (CRS), ASR 9000, NCS 5500, and 8000 series. The vulnerability specifically impacts devices with BGP confederation configured.

Successful exploitation allows unauthenticated attackers to remotely crash vulnerable devices through memory corruption via buffer overflow, forcing a BGP process restart. According to Cisco’s security advisory, “This vulnerability is due to a memory corruption that occurs when a BGP update is created with an AS_CONFED_SEQUENCE attribute that has 255 autonomous system numbers.”

## Attack Requirements

For an attack to succeed, either:
– The network must be designed so the AS_CONFED_SEQUENCE attribute grows to 255 or more AS numbers, or
– The attacker must control a BGP confederation speaker within the same autonomous system as the target

## Affected Versions and Fixes

| IOS XR Software Release | Recommended Action |
|————————-|——————-|
| 7.11 and earlier | Migrate to a fixed release |
| 24.1 and earlier | Migrate to a fixed release |
| 24.2 | Upgrade to 24.2.21 (future release) |
| 24.3 | Upgrade to 24.3.1 |
| 24.4 | Not affected |

## Mitigation

Organizations unable to immediately patch should restrict the BGP AS_CONFED_SEQUENCE attribute to 254 or fewer AS numbers to limit potential attack impact. Cisco notes this workaround has been tested successfully but recommends customers evaluate its effectiveness in their specific environments.

Cisco’s Product Security Incident Response Team (PSIRT) has found no evidence of exploitation in the wild, though technical details were published in September on APNIC’s blog.