CVE-2025-20338

CWE-1414 documents4 sources
Severity
6.7MEDIUM
EPSS
0.0%
top 98.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco IOS XE SoftwareCisco IOS XE
Timeline
PublishedSep 24

Description

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by logging in to the device CLI with valid administrative (level 15) credentials and using crafted commands at the CLI…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 0.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_software374 versions+373
▶NVDcisco/ios_xe374 versions+373

🔴Vulnerability Details

2
CVEList
CVE-2025-20338: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary c↗2025-09-24
▶
GHSA
GHSA-5gjp-3q99-vxx5: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary c↗2025-09-24
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software CLI Argument Injection Vulnerability↗2025-09-24
▶