CVE-2025-20202

Katalog CVE

CVSS 7.4 · High EPSS 0,23%

Kerentanan Buffer Access with Incorrect Length Value pada cisco ios xe. Skor CVSS 3.1 7.4 (High) menurut cisco.com.

Deskripsi (NVD)

A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of access point (AP) Cisco Discovery Protocol (CDP) neighbor reports when they are processed by the wireless controller. An attacker could exploit this vulnerability by sending a crafted CDP packet to an AP. A successful exploit could allow the attacker to cause an unexpected reload of the wireless controller that is managing the AP, resulting in a DoS condition that affects the wireless network.

Rincian

Terbit di NVD

7 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber cisco.com
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-805: Buffer Access with Incorrect Length Value

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 153 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-cdp-dos-fpeks9K advisory vendor