CVE-2025-20311
published 2025-09-24CVE-2025-20311: A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent…
PriorityP337high7.4CVSS 3.1
AVAACLPRNUINSCCNINAH
EPSS
0.20%
10.0th percentile
A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic.
This vulnerability is due to improper handling of crafted Ethernet frames. An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. A successful exploit could allow the attacker to cause the egress port to which the crafted frame is forwarded to start dropping all frames, resulting in a denial of service (DoS) condition.
Affected
207 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
| cisco | cisco_ios_xe_software | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
vendor_cisco7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Cisco IOS XE up to 17.16.1 Ethernet Frame data processing (cisco-sa-cat9k-PtmD7bgy / Nessus ID 282326)
vuldb·2026-09-18·CVSS 7.4
CVE-2025-20311 [HIGH] Cisco IOS XE up to 17.16.1 Ethernet Frame data processing (cisco-sa-cat9k-PtmD7bgy / Nessus ID 282326)
A vulnerability was found in Cisco IOS XE. It has been rated as critical. Impacted is an unknown function of the component Ethernet Frame Handler. This manipulation causes data processing error.
The identification of this vulnerability is CVE-2025-20311. The attack needs to be done within the local network. There is no exploit available.
Upgrading the affected component is advised.
GHSA
GHSA-pr4q-4px5-72j6: A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated,
ghsa_unreviewed·2025-09-24
CVE-2025-20311 [HIGH] GHSA-pr4q-4px5-72j6: A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated,
A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic.
This vulnerability is due to improper handling of crafted Ethernet frames. An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. A successful exploit could allow the attacker to cause the egress port to which the crafted frame is forwarded to start dropping all frames, resulting in a denial of service (DoS) condition.
Cisco
Cisco IOS XE Software for Catalyst 9000 Series Switches Denial of Service Vulnerability
vendor_cisco·2025-09-24·CVSS 7.4
CVE-2025-20311 [HIGH] CWE-19 Cisco IOS XE Software for Catalyst 9000 Series Switches Denial of Service Vulnerability
Cisco IOS XE Software for Catalyst 9000 Series Switches Denial of Service Vulnerability
A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic.
This vulnerability is due to improper handling of crafted Ethernet frames. An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. A successful exploit could allow the attacker to cause the egress port to which the crafted frame is forwarded to start dropping all frames, resulting in a denial of service (DoS) condition.
Cisco has released software updates that address this vulnerability. There are no workarounds
Cisco
Cisco IOS XE Software for Catalyst 9000 Series Switches Denial of Service Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20311 Cisco IOS XE Software for Catalyst 9000 Series Switches Denial of Service Vulnerability
CVE-2025-20311: Cisco IOS XE Software for Catalyst 9000 Series Switches Denial of Service Vulnerability
A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic. This vulnerability is due to improper handling of crafted Ethernet frames. An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. A successful exploit could allow the attacker to cause the egress port to which the crafted frame is forwarded to start dropping all frames, resulting in a denial of service (DoS) condition. Cisco has released software updates that address this vulnerability. There are no
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-24
Published