Auth bypass in Cisco iOS Xe Software
CVE-2025-20160
A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required TACACS+ shared secret is configured. A machine-in-the-middle attacker could exploit this vulnerability by intercepting and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and falsely accepting arbitrary authentication requests. A successful exploit could allow the attacker to view sensitive information in a TACACS+ message or bypass authentication and gain access to the affected device.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (35.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 35.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.004 · change: -0.000
Affected products
- Cisco iOS Xe Software — versions 3.16.8S, 3.16.9S, 3.16.10S
- Cisco iOS — versions 15.2(8)e4, 15.2(7)e0s, 15.9(3)M3b
- Cisco iOS Xe — versions 16.10.1, 16.10.1a, 16.10.1b
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-20160?
- CVE-2025-20160 is a high-severity vulnerability in Cisco iOS Xe Software, classified under Improper Authentication. CVSS score: 8.1/10. Published 2025-09-24.
- How severe is CVE-2025-20160?
- High severity. CVSS v3 base score is 8.1 out of 10.