Summary

• A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.

  This vulnerability is due to incorrect handling of packets when a specific configuration of the hybrid ACL exists. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass a configured ACL on the affected device.

  For more information, see the Details section of this advisory.

  Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs-hybridacl-crMZFfKQ

  This advisory is part of the March 2025 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2025 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication.

Affected Products

• Vulnerable Products

  At the time of publication, this vulnerability affected the following products if they were running a vulnerable release of Cisco IOS XR Software and had a hybrid IPv4 ACL configured with compress level 3 that matches specific characteristics:

  • IOS XR White box (IOSXRWBD)
  • Network Convergence Series (NCS) 540 Series Routers
  • NCS 560 Series Routers
  • NCS 5500 Series
  • NCS 5700 Series

  For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

  Determine Whether a Hybrid IPv4 ACL is Vulnerable

  1. Determine whether the device has a hybrid ACL configured.

  To determine whether a hybrid IPv4 ACL is configured, use the show running-config | include ipv4 access-group .* compress level 3 CLI command. If the command returns output, a hybrid IPv4 ACL is configured, as shown in the following example:

  RP/0/RP0/CPU0:Router#show running-config | include ipv4 access-group .* compress level 3
  Wed Mar  12 16:00:00.000 UTC
  Building configuration...
   ipv4 access-group IngressACL ingress compress level 3
  RP/0/RP0/CPU0:Router#

  If it is not configured, the device is not affected by this vulnerability.

  If it is configured, proceed to Step 2.

  2. Examine the ACLs.

  To examine the contents of each hybrid ACL that was identified in the previous step, use the show access-list <Name of ACL> CLI command. If the number of different source network object groups is 32 or more or if the number of different destination network object groups is 32 or more, proceed to Step 3. If the number is less than 32, the ACL is not affected by this vulnerability.

  The following example shows 33 access control entries (ACEs) with 33 unique source network object groups and 33 unique destination network object groups:

  RP/0/RP0/CPU0:Router#show access-lists CSCwi49569_long
  Wed Mar  12 16:00:00.000 UTC
  ipv4 access-list CSCwi49569_long
   400000 permit ipv4 net-group 1_SRC_100 net-group 1_DST_100
   400001 permit ipv4 net-group 1_SRC_101 net-group 1_DST_101
   400002 permit ipv4 net-group 1_SRC_102 net-group 1_DST_102
   400003 permit ipv4 net-group 1_SRC_103 net-group 1_DST_103
   400004 permit ipv4 net-group 1_SRC_104 net-group 1_DST_104
   400005 permit ipv4 net-group 1_SRC_105 net-group 1_DST_105
   400006 permit ipv4 net-group 1_SRC_106 net-group 1_DST_106
   400007 permit ipv4 net-group 1_SRC_107 net-group 1_DST_107
   400008 permit ipv4 net-group 1_SRC_108 net-group 1_DST_108
   400009 permit ipv4 net-group 1_SRC_109 net-group 1_DST_109
   400010 permit ipv4 net-group 1_SRC_110 net-group 1_DST_110
   400011 permit ipv4 net-group 1_SRC_111 net-group 1_DST_111
   400012 permit ipv4 net-group 1_SRC_112 net-group 1_DST_112
   400013 permit ipv4 net-group 1_SRC_113 net-group 1_DST_113
   400014 permit ipv4 net-group 1_SRC_114 net-group 1_DST_114
   400015 permit ipv4 net-group 1_SRC_115 net-group 1_DST_115
   400016 permit ipv4 net-group 1_SRC_116 net-group 1_DST_116
   400017 permit ipv4 net-group 1_SRC_117 net-group 1_DST_117
   400018 permit ipv4 net-group 1_SRC_118 net-group 1_DST_118
   400019 permit ipv4 net-group 1_SRC_119 net-group 1_DST_119
   400020 permit ipv4 net-group 1_SRC_120 net-group 1_DST_120
   400021 permit ipv4 net-group 1_SRC_121 net-group 1_DST_121
   400022 permit ipv4 net-group 1_SRC_122 net-group 1_DST_122
   400023 permit ipv4 net-group 1_SRC_123 net-group 1_DST_123
   400024 permit ipv4 net-group 1_SRC_124 net-group 1_DST_124
   400025 permit ipv4 net-group 1_SRC_125 net-group 1_DST_125
   400026 permit ipv4 net-group 1_SRC_126 net-group 1_DST_126
   400027 permit ipv4 net-group 1_SRC_127 net-group 1_DST_127
   400028 permit ipv4 net-group 1_SRC_128 net-group 1_DST_128
   400029 permit ipv4 net-group 1_SRC_129 net-group 1_DST_129
   400030 permit ipv4 net-group 1_SRC_130 net-group 1_DST_130
   400031 permit ipv4 net-group 1_SRC_131 net-group 1_DST_131
   400032 permit ipv4 net-group 1_SRC_132 net-group 1_DST_132
  RP/0/RP0/CPU0:Router#

  3. Examine the object groups.

  If the command returns output with 32 or more different source network object groups or 32 or more different destination network object groups, then it is necessary to examine the contents of each group that appears in each ACE using the show object-group network ipv4 <name of each network object-group> CLI command from the previous step.

  If the same IPv4 prefix, host, or range entry is found in 32 or more of the source network object groups or in 32 or more of the destination network object groups, then the ACL is affected by this vulnerability.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that this vulnerability does not affect the following Cisco products:

  • IOS Software
  • IOS XE Software
  • NX-OS Software

Details

• Exploitation of this vulnerability could allow an attacker to bypass protections that are provided by an ACL that is applied on an affected device. The overall impact of exploitation is organization specific because it depends on the importance of the assets that the ACL was supposed to protect. Customers should evaluate how exploitation of this vulnerability would impact their network and proceed according to their own vulnerability-handling and remediation processes.

Workarounds

• There is a workaround that addresses this vulnerability.

  Examine the object groups that make up the ACL. If the same IPv4 source or destination or both appear more than 31 times in object groups that comprise the ACL, remove access control entries until there are 31 or fewer entries of the same IPv4 address in both the source and destination entries.

  While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Fixed Software

• When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

  Fixed Releases

  At the time of publication, the release information in the following table(s) was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

  In the following table, the left column lists Cisco software releases or trains. The right column indicates whether a release (train) is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability.

  Cisco IOS XR Software Release	First Fixed Release
  7.10 and earlier	Migrate to a fixed release.
  7.11	7.11.2
  24.1 and later	Not affected.

  SMUs are also available to address this vulnerability. Customers who require SMUs for platforms or releases that are not available are advised to contact their support organization. For more information on finding which SMUs may have been published for this vulnerability, see the Download section of Understand Cisco IOS XR Software Maintenance Updates (SMUs).

  The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• This vulnerability was found during internal security testing.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs-hybridacl-crMZFfKQ

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	-	Final	2025-MAR-12

  Show Less