Cisco Products Multiple Vulnerabilities

Multiple vulnerabilities were identified in Cisco products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, cross-site scripting, security restriction bypass, remote code execution and sensitive information disclosure on the targeted system.

Note:

CVE-2025-20352 is being exploited in the wild. An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software.

An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software.

Proof of Concept exploit code is publicly available for CVE-2025-20149. An authenticated, local attacker could exploit this vulnerability to trigger denial of service condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software.

Proof of Concept exploit code is publicly available for CVE-2025-20240. A remote attacker could exploit this vulnerability by persuading a user to click a malicious link, triggering cross-site scripting on an affected device that is running Cisco IOS XE Software.

Hence, the risk level is rated as High Risk.

RISK: High Risk

TYPE: Security software and application – Security Software & Appliance

Impact

Denial of Service
Security Restriction Bypass
Remote Code Execution
Cross-Site Scripting
Information Disclosure

System / Technologies affected

Cisco IOS
Cisco IOS XE

For affected versions, please refer to the link issued by the vendor:

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

Vulnerability Identifier

Source

Cisco