Cisco has issued an urgent security advisory (cisco-sa-twamp-kV4FHugn) warning of a critical vulnerability in its widely used IOS, IOS XE, and IOS XR software.
The flaw, tracked as CVE-2025-20154, allows unauthenticated attackers to trigger denial-of-service (DoS) conditions by forcing devices to reboot remotely.
The weakness stems from improper handling of Two-Way Active Measurement Protocol (TWAMP) control packets. Attackers exploiting this flaw can send crafted requests that cause:
Cisco confirms no workarounds exist, emphasizing immediate patching as the only remedy.
Affected Products
| Product | Impact | CVSS Score | Affected Versions |
| Cisco IOS | Full device reload | 8.6 | All TWAMP-enabled installations |
| IOS XE | Full device reload | 8.6 | 16.6.1–17.2.3 (with debugs) Other releases up to fixed versions |
| IOS XR | Process crash (debug mode only) | 3.7 | TWAMP-enabled + active debugs |
The risk associated with CVE-2025-20154 is significant, particularly for organizations relying on Cisco IOS, IOS XE, and IOS XR devices in core network roles.
The vulnerability’s high CVSS score of 8.6 for IOS and IOS XE highlights the potential for substantial disruption, as an unauthenticated remote attacker could send specially crafted TWAMP control packets to trigger a device reload and cause a denial-of-service (DoS) event.
This could lead to service outages, interrupted business operations, and degraded network reliability, especially in environments where the Twenty-Way Active Measurement Protocol (TWAMP) is enabled for network performance monitoring.
For IOS XR deployments, while the impact is somewhat lower (CVSS 3.7), the vulnerability can still cause the ipsla_ippm_server process to crash if debugging is enabled, potentially affecting performance monitoring and diagnostics.
The absence of available workarounds and the ease of exploitation on internet-facing devices further increase the risk.
Therefore, organizations using affected Cisco products in mission-critical or exposed settings should treat this vulnerability as a priority for immediate patching and remediation.
Setting Up SOC Team? – Download Free Ultimate SIEM Pricing Guide (PDF) For Your SOC Team -> Free Download
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…