CVE-2025-20340High· 7.4▾ TwilightA vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service (DoS) condition on an affecte…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
0.6% → 0.6%
A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service (DoS) condition on an affected device.
This vulnerability is due to how Cisco IOS XR Software processes a high, sustained rate of ARP traffic hitting the management interface. Under certain conditions, an attacker could exploit this vulnerability by sending an excessive amount of traffic to the management interface of an affected device, overwhelming its ARP processing capabilities. A successful exploit could result in degraded device performance, loss of management connectivity, and complete unresponsiveness of the system, leading to a DoS condition.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-20138High· 8.8Cisco IOS XR Software CLI Privilege Escalation Vulnerability (CVE-2025-20138)
CVE-2025-20115High· 8.6Cisco IOS XR Software Border Gateway Protocol Denial of Service Vulnerability
CVE-2025-20142High· 8.6Cisco IOS XR Software for ASR 9000 Series Routers L2VPN Denial of Service Vulnerability
CVE-2025-20143Medium· 6.7Cisco IOS XR Software Secure Boot Bypass Vulnerability (CVE-2025-20143)
CVE-2025-20146High· 8.6Cisco IOS XR Software for ASR 9000 Series Routers Layer 3 Multicast Routing Denial of Service Vulnerability
CVE-2024-20304High· 8.6Cisco IOS XR Software Packet Memory Exhaustion Vulnerability