CVE-2025-20338

Katalog CVE

CVSS 6.7 · Medium EPSS 0,16%

Kerentanan Improper Neutralization of Parameter/Argument Delimiters pada cisco ios xe. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by logging in to the device CLI with valid administrative (level 15) credentials and using crafted commands at the CLI prompt. A successful exploit could allow the attacker to execute arbitrary commands as root.

Rincian

Terbit di NVD

24 September 2025

Terakhir diubah

26 September 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-141: Improper Neutralization of Parameter/Argument Delimiters

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 374 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-arg-inject-EyDDbh... advisory vendor