CVE-2025-20149

CWE-120 — Classic Buffer OverflowCWE-668 — Exposure to Wrong Sphere5 documents5 sources
Severity
6.5MEDIUM
EPSS
0.0%
top 91.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco IOS XE SoftwareCisco IOS
Timeline
PublishedSep 24

Description

A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a buffer overflow. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condi…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HExploitability: 2.0 | Impact: 4.0

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_software420 versions+419
▶CVEListV5cisco/ios739 versions+738

🔴Vulnerability Details

2
CVEList
CVE-2025-20149: A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to↗2025-09-24
▶
GHSA
GHSA-833m-h6fc-hmvx: A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to↗2025-09-24
▶

📋Vendor Advisories

2
Cisco
Cisco IOS and IOS XE Software CLI Denial of Service Vulnerability↗2025-09-24
▶
Microsoft
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name as demonstrated by 'constructor': {'name':'Symbol'}. Hence a crafted p↗2019-12-10
▶
CVE-2025-20149 (MEDIUM CVSS 6.5) | A vulnerability in the CLI of Cisco | cvebase.io