CVE-2025-20189
A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper memory management when Cisco IOS XE Software is processing Address Resolution Protocol (ARP) messages. An attacker could exploit this vulnerability by sending crafted ARP messages at a high rate over a period of time to an affected device. A successful exploit could allow the attacker to exhaust system resources, which eventually triggers a reload of the active route switch processor (RSP). If a redundant RSP is not present, the router reloads.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.4
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- EPSS probability
- 0.24%
- CWE
- CWE-762
- Published
- 2025-05-07
- Last modified
- 2026-03-12
Affected products
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
Weakness type
Related vulnerabilities
- CVE-2026-43622 — llama.cpp b1886–b7445 Double Free via llama-android.cpp
- CVE-2025-48431 — Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
- CVE-2025-11015 — OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines
- CVE-2025-48755 — In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).
- CVE-2025-47737 — lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.
- CVE-2024-4853 — Mismatched Memory Management Routines in editcap
- CVE-2024-2955 — Mismatched Memory Management Routines in Wireshark
- CVE-2023-41056 — Redis vulnerable to integer overflow in certain payloads