Cisco IOS and IOS XE Software TACACS+ Authentication Bypass Vulnerability

🚨SEVERITY: HIGH — CVSS 8.1Security Advisory

TL;DR 📌

  • A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required TACACS+ shared secret is configured. A machine-in-the-middle attacker could exploit this…
  • Highest CVSS: 8.1 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20160.

What it is

CVE-2025-20160 is a flaw in how Cisco IOS Software and IOS XE Software handle the TACACS+ protocol. The issue arises when a device is configured to use TACACS+ but does not have the required TACACS+ shared secret configured on one or more servers. In that state, the device fails to enforce the check that would normally require a shared secret before trusting TACACS+ traffic.

The access path is a machine-in-the-middle position on the network path between the device and its TACACS+ server. From there, an attacker can read unencrypted TACACS+ messages to extract sensitive information, or impersonate the TACACS+ server itself and have the device falsely accept arbitrary authentication requests. This is not a data-plane issue; it sits in the AAA/authentication path used for administrative access to the device.

A successful exploit lets the attacker either view sensitive data carried in TACACS+ messages or bypass authentication outright and gain access to the affected device. Cisco rates this 8.1 (High), reflecting the network attack vector combined with the high complexity of positioning as a machine-in-the-middle (AC:H) and no privileges or user interaction required.

Cisco IOS XR Software and NX-OS Software are confirmed not affected. This advisory is part of Cisco’s September 2025 semiannual IOS/IOS XE bundled publication.

What to do

  • Check whether TACACS+ is configured at all: run show running-config | include tacacs (or | section tacacs) on affected devices. No output means the device isn’t exposed to this issue.
  • If TACACS+ is configured, verify every server has a shared secret: run show running-config | include tacacs server|key. Any TACACS+ server entry without a following key line means that device is affected — this applies whether servers are configured via groups, without groups, or with server-private.
  • As an immediate workaround, configure a shared secret (key) for every TACACS+ server defined on the device, or set a global key with tacacs-server key. Test this in your own environment first, as Cisco notes workarounds can affect functionality.
  • Plan to move to fixed IOS/IOS XE software as the permanent remediation. The advisory doesn’t list specific fixed release numbers here — use the Cisco Software Checker against your current release to get the “First Fixed” and “Combined First Fixed” versions for your train.
  • Cisco PSIRT states it is not aware of any public exploitation of this vulnerability at time of publication.

For leadership 🧭

Executive summary. Devices using TACACS+ for administrative login are only protected if every configured TACACS+ server has a shared secret set; where one is missing, an attacker who can sit on the path to the TACACS+ server can read credentials or forge acceptance and log in. This affects the authentication path for device management, so it should be checked this week rather than left for a routine patch cycle.

Why it matters:

  • The gap is specifically in the AAA/TACACS+ path used to authenticate administrators onto IOS and IOS XE devices, not in general data traffic.
  • A missing shared secret on even one TACACS+ server entry (whether configured via groups, without groups, or with server-private) leaves that path exploitable, even if other servers are correctly keyed.
  • A machine-in-the-middle attacker can either read sensitive TACACS+ message contents or impersonate the server outright to have the device accept arbitrary logins, meaning administrative access to the device itself is at stake.
  • IOS XR and NX-OS are confirmed unaffected, so exposure is limited to devices running IOS or IOS XE with TACACS+ enabled.

Now / Next / Later:

  • Now: On each IOS/IOS XE device, run show running-config | include tacacs to confirm TACACS+ is configured, then show running-config | include tacacs server|key to check whether every listed TACACS+ server has a following key line.
  • Next: For any TACACS+ server missing a shared secret, configure one (per-server key or a global tacacs-server key) during a change window, after confirming in a test environment that it doesn’t disrupt existing AAA behaviour.
  • Later: Move affected devices to a fixed IOS/IOS XE release identified via the Cisco Software Checker, and add shared-secret verification for all TACACS+ servers to standard device build and audit checks.

Source