A dangerous security vulnerability in Cisco IOS XR software threatens to wreak havoc on major networks worldwide. The high-severity flaw, tracked as CVE-2025-20115 with a CVSS score of 8.6, allows unauthenticated attackers to crash the BGP process with just one malicious update message. No big deal, just the potential collapse of internet routing for major carriers.
The vulnerability specifically targets Cisco’s BGP confederation implementation. When an attacker sends a crafted BGP update containing an AS_CONFED_SEQUENCE attribute with 255 or more AS numbers, it triggers memory corruption. The BGP process restarts. Network goes boom. This affects everything from Network Convergence System routers to Carrier Routing System devices – basically the backbone equipment powering global communications.
BGP confederation? Meet its kryptonite: 255+ AS numbers in one packet. Memory corrupts. Routers crash. Internet implodes.
Here’s the kicker: exploitation requires BGP confederation to be enabled. That’s the good news. The bad news? Successful attacks could cascade across interconnected networks, causing widespread outages. Similar to the recently discovered command injection vulnerabilities in Cisco IOS XR CLI, these issues highlight critical security gaps in network infrastructure. Organizations implementing defense in depth strategies are better positioned to detect and mitigate such threats before they cause catastrophic damage. Affected systems primarily include versions that process Mtrace2 packets for both IPv4 and IPv6 multicast traffic. Major carriers rely on these systems. Your internet access depends on them working properly. See the problem?
Cisco released patches on March 12, 2025, for affected versions. Unpatched systems include IOS XR Software Release 7.11 and earlier, releases 24.1 and earlier, and specific versions of 24.2 and 24.3. Release 24.4 dodged this bullet entirely. Lucky them.
For those who can’t patch immediately (because patching core routers is just so convenient), Cisco offers a temporary workaround: restrict BGP AS_CONFED_SEQUENCE to 254 or fewer AS numbers. Not ideal, but better than nothing.
The company claims no exploitation has been detected in the wild. Yet. But with details now public, that clock is ticking. This vulnerability underscores persistent security challenges in critical internet infrastructure. BGP remains notoriously fragile despite powering global routing.
The lesson? Patch your systems. Or don’t, if you enjoy explaining to executives why the entire network collapsed from a single malicious packet.
