Cisco IOS XE Software Bootstrap Arbitrary File Write Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.0Security Advisory

TL;DR 📌

  • A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when…
  • Highest CVSS: 6.0 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20155.

What it is

CVE-2025-20155 sits in the bootstrap-loading code of Cisco IOS XE Software, specifically in how the system reads the bootstrap file used when a device is first deployed in SD-WAN mode or when SD-Routing is configured. The bootstrap file itself is normally generated by Cisco Catalyst SD-WAN Manager. Insufficient input validation of that file means its contents aren’t properly checked before being acted on.

Exploitation requires an authenticated, local attacker who can modify a bootstrap file and load it into the device’s flash. The attack is completed either by reloading the device during a green-field SD-WAN deployment, or by configuring SD-Routing on the device with the tampered file present. At that point, the software processes the file and the attacker can write arbitrary files to the underlying operating system.

This is not a remote, unauthenticated flaw — there’s no network-facing access path described. It’s a local, authenticated issue tied to a specific provisioning workflow (initial SD-WAN bring-up or SD-Routing configuration), rather than something reachable via the management or data plane in normal operation. The CVSS vector confirms this: local access vector, low attack complexity, high privileges required, no user interaction, with confidentiality and integrity impact rated high and availability unaffected.

Cisco IOS Software, IOS XR Software, Meraki products, and NX-OS Software are confirmed not affected. Only Cisco IOS XE Software supporting Catalyst SD-WAN or SD-Routing functionality is in scope, regardless of whether that functionality is actively configured on the device.

What to do

  • Identify any devices running Cisco IOS XE Software with Catalyst SD-WAN or SD-Routing support — exposure applies regardless of current configuration, so inventory should include devices where the functionality is merely supported, not just enabled.
  • Use the Cisco Software Checker against your running release to get the specific fixed version for this advisory (cisco-sa-bootstrap-KfgxYgdh); no fixed version numbers are listed here, so run the checker or consult the advisory directly for the exact target release.
  • There is no workaround. Patching is the only mitigation Cisco offers for this issue.
  • Tighten control over who can generate, handle, and load bootstrap files from Cisco Catalyst SD-WAN Manager — since exploitation depends on a tampered bootstrap file reaching device flash, restricting access to that file and to flash write operations reduces the practical attack surface ahead of patching.
  • Cisco states it is not aware of public announcements or malicious use of this vulnerability, and it is not listed in CISA’s KEV catalogue.

For leadership 🧭

Executive summary. Devices running Cisco IOS XE with Catalyst SD-WAN or SD-Routing support can have their provisioning bootstrap file tampered with, allowing a local authenticated attacker to write files to the operating system during first-time setup. There’s no known exploitation and no remote path, so this should go into the next patch cycle rather than being treated as an emergency.

Why it matters:

  • Exploitation requires an authenticated local attacker to modify a bootstrap file normally generated by Cisco Catalyst SD-WAN Manager, then get it onto device flash before a green-field SD-WAN reload or SD-Routing configuration step
  • Any device that merely supports Catalyst SD-WAN or SD-Routing functionality is in scope, even if that functionality isn’t currently enabled, which widens the inventory beyond actively configured SD-WAN devices
  • A successful write gives high confidentiality and integrity impact on the underlying OS, though availability is unaffected and there’s no network-facing route in
  • Cisco offers no workaround for this issue, so devices remain exposed until the fixed IOS XE release is installed

Now / Next / Later:

  • Now: Run the Cisco Software Checker against your current IOS XE release to confirm whether your devices are affected and identify the fixed release for advisory cisco-sa-bootstrap-KfgxYgdh.
  • Next: Schedule the upgrade to the fixed IOS XE release for all devices supporting Catalyst SD-WAN or SD-Routing, prioritising any due for green-field SD-WAN deployment or SD-Routing configuration.
  • Later: Restrict who can generate, handle, and load bootstrap files from Cisco Catalyst SD-WAN Manager, and control flash write access on IOS XE devices, so a tampered provisioning file can’t reach the device even before patches are applied.

Source