CVE-2025-20221 is a medium severity (5.3) flaw in the packet filtering features of Cisco IOS XE SD-WAN Software. An unauthenticated remote attacker could bypass Layer 3 and Layer 4 traffic filters. Cisco has released fixed software and a workaround, so use the Cisco Software Checker and apply either.
What's affected
Cisco's advisory, published 7 May 2025 as part of its May 2025 IOS and IOS XE bundled publication, says the flaw affects universal Cisco IOS XE Software releases 17.2.1r and later running in Controller mode. It also lists standalone IOS XE SD-WAN releases 16.9.1 through 16.9.4, 16.10.1 through 16.10.5, 16.11.1a and 16.12.2r through 16.12.4.
A revision on 22 September 2025 clarified the vulnerable configuration. Cisco SD-WAN cEdge routers are affected when SNMP is enabled on any SD-WAN tunnel interface. Without SNMP, the device is not affected. The weakness is mapped to CWE-200 in the record, and the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Cisco says its Product Security Incident Response Team is aware that proof of concept exploit code exists, and is not aware of any malicious use. The record is not on the CISA Known Exploited Vulnerabilities list.
Fixed versions: Cisco does not list them in a table in the advisory body. It points to the Cisco Software Checker, which returns the first fixed release for your software version.
How to check if you're exposed
Cisco gives these commands to see whether SNMP is enabled. For SNMP version 1 or community based version 2c, run the following and check for output.
show running-config | include snmp-server community
For SNMP version 3, run both of these. If both return output, SNMPv3 is enabled.
show running-config | include snmp-server group
show snmp user
Then confirm the device is in Controller mode and check the software release. Run it through the Cisco Software Checker, choosing this advisory, to get the first fixed release.
What to do now
- List your cEdge and IOS XE SD-WAN devices and the release each one runs.
- Check each device for SNMP on SD-WAN tunnel interfaces using the commands above.
- Run each release through the Cisco Software Checker for this advisory.
- Upgrade to the fixed release it returns, following your change process.
- If you cannot upgrade yet, use Cisco's workaround from the SD-WAN Manager interface. Configure an extended ACL that restricts ingress and egress traffic to and from the device, or push a device access policy that blocks unsolicited SNMP traffic.
- Test the workaround in your own environment first. Cisco notes it may affect functionality or performance.
- Treat the workaround as temporary until you have upgraded.
Why it matters
A filter bypass does not give the attacker the device. It lets a crafted packet reach a place the filter was meant to guard. The advisory describes injecting a crafted packet into the network, which matters because many networks rely on those filters to keep management traffic and internal segments apart.
The condition is narrow, and that is useful. If your devices do not run SNMP on tunnel interfaces, they are not affected, and a short configuration check tells you so. This is a good reminder to keep management protocols off interfaces that do not need them.
Quick check
Am I affected if SNMP is switched off?
According to the advisory, a cEdge router without SNMP enabled on an SD-WAN tunnel interface is not affected. Confirm with the configuration commands, and still plan the upgrade.
Is this being exploited?
Cisco says it is aware of proof of concept code and not aware of malicious use. The record is not on the CISA Known Exploited Vulnerabilities list.
Sources
Last reviewed: 19 October 2026.
