Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers ARP Denial

🚨SEVERITY: HIGH — CVSS 7.4Security Advisory

TL;DR 📌

  • A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper memory management when Cisco IOS XE Software is processing…
  • Highest CVSS: 7.4 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20189.

What it is

CVE-2025-20189 affects Cisco IOS XE Software running on ASR 903 Aggregation Services Routers fitted with Route Switch Processor 3 (RSP3C). The flaw sits in the Cisco Express Forwarding functionality, specifically in how the device handles Address Resolution Protocol (ARP) messages.

The problem is improper memory management: an attacker who can reach the device on its local segment sends crafted ARP messages at a high rate over a period of time. This causes memory exhaustion in the uea_mgr process, which normally holds around 1 GB (1,048,576 bytes) of RSS memory. Cisco notes that unexpected RSP reloads have been observed once uea_mgr’s RSS usage reaches around 1.7 GB (1,782,580 bytes).

No authentication is required — the CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms this is an unauthenticated, adjacent-network attack with low complexity and no user interaction. The impact is availability only (C:N/I:N/A:H): sustained exploitation exhausts system resources and eventually forces a reload of the active RSP. If the router has no redundant RSP installed, the entire router reloads. The vulnerability applies regardless of device configuration, and only ASR 903 routers with RSP3C are affected — other IOS XE platforms, IOS, IOS XR, NX-OS and Meraki products are confirmed not vulnerable.

What to do

  • Identify any ASR 903 routers running RSP3C in your estate — this is the only affected combination.
  • Use the Cisco Software Checker against this advisory (cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ) to find the first fixed release for your current train, since no specific fixed version numbers are listed here.
  • There is no workaround. As an interim mitigation, monitor uea_mgr RSS memory with show process memory platform sorted | include RSS|uea_mgr. Baseline is around 1 GB; treat sustained growth well above that as a warning sign, and schedule a planned RSP reload before usage approaches the ~1.7 GB level where uncontrolled reloads have been observed.
  • Prioritise devices without a redundant RSP, since on those a successful attack reloads the whole router rather than just failing over.
  • Plan the upgrade through normal maintenance windows via your Cisco support channel — Cisco has not published exploitation in the wild for this CVE.

For leadership 🧭

Executive summary. ASR 903 routers fitted with RSP3C can be knocked offline by anyone with local network access sending high rates of crafted ARP traffic, with no login required. There is no workaround, so affected devices should be identified and scheduled for a software upgrade in the next maintenance window; routers without a redundant RSP are at greater risk since the whole device reloads rather than failing over.

Why it matters:

  • Only ASR 903 Aggregation Services Routers running RSP3C are affected, but the flaw triggers regardless of how the device is configured, so there’s no safe configuration to fall back on.
  • The attack needs no credentials and only adjacent network access, sending crafted ARP messages to exhaust the uea_mgr process, which normally sits around 1GB RSS and has caused reloads near 1.7GB.
  • Devices without a redundant RSP suffer a full router reload rather than a failover, meaning a complete loss of routing on that box until it recovers.
  • Cisco has confirmed there is no workaround, so the only durable fix is upgrading to a patched IOS XE release identified via the Software Checker.

Now / Next / Later:

  • Now: Check whether any ASR 903 routers in the estate are fitted with RSP3C, since these are the only affected devices.
  • Next: Run the Cisco Software Checker against advisory cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ for each affected router’s current release to find the first fixed version, and schedule the upgrade through a maintenance window, prioritising routers without a redundant RSP.
  • Later: Until upgraded, monitor uea_mgr RSS memory with the documented show command and schedule planned RSP reloads before usage approaches the ~1.7GB level where uncontrolled reloads have been observed.

Source