A critical vulnerability has been identified in Cisco IOS Software and Cisco IOS XE Software's implementation of the TACACS+ protocol. This flaw allows unauthenticated, remote attackers to access sensitive data or bypass authentication mechanisms. The issue arises from improper validation of the required TACACS+ shared secret configuration. An attacker performing a man-in-the-middle attack could intercept unencrypted TACACS+ messages. They could also impersonate the TACACS+ server and accept any authentication request. Successful exploitation grants the attacker the ability to view sensitive information within TACACS+ messages. Alternatively, an attacker could bypass authentication entirely, gaining unauthorized access. Cisco has released software updates to fix this vulnerability. Workarounds are also available to mitigate the risk. The security impact of this vulnerability is rated as High, and it is identified as CVE-2025-20160.