CVE-2025-20193
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against an affected device.r This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface. A successful exploit could allow the attacker to read files from the underlying operating system.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco IOS XE Software | 17.3.1 | affected |
| Cisco | Cisco IOS XE Software | 17.3.2 | affected |
| Cisco | Cisco IOS XE Software | 17.3.3 | affected |
| Cisco | Cisco IOS XE Software | 17.3.1a | affected |
| Cisco | Cisco IOS XE Software | 17.3.1w | affected |
| Cisco | Cisco IOS XE Software | 17.3.2a | affected |
| Cisco | Cisco IOS XE Software | 17.3.1x | affected |
| Cisco | Cisco IOS XE Software | 17.3.1z | affected |
| Cisco | Cisco IOS XE Software | 17.3.4 | affected |
| Cisco | Cisco IOS XE Software | 17.3.5 | affected |
| Cisco | Cisco IOS XE Software | 17.3.4a | affected |
| Cisco | Cisco IOS XE Software | 17.3.6 | affected |
| Cisco | Cisco IOS XE Software | 17.3.4b | affected |
| Cisco | Cisco IOS XE Software | 17.3.4c | affected |
| Cisco | Cisco IOS XE Software | 17.3.5a | affected |
| Cisco | Cisco IOS XE Software | 17.3.5b | affected |
| Cisco | Cisco IOS XE Software | 17.3.7 | affected |
| Cisco | Cisco IOS XE Software | 17.3.8 | affected |
| Cisco | Cisco IOS XE Software | 17.3.8a | affected |
| Cisco | Cisco IOS XE Software | 17.4.1 | affected |
| Cisco | Cisco IOS XE Software | 17.4.2 | affected |
| Cisco | Cisco IOS XE Software | 17.4.1a | affected |
| Cisco | Cisco IOS XE Software | 17.4.1b | affected |
| Cisco | Cisco IOS XE Software | 17.4.2a | affected |
| Cisco | Cisco IOS XE Software | 17.5.1 | affected |
| Cisco | Cisco IOS XE Software | 17.5.1a | affected |
| Cisco | Cisco IOS XE Software | 17.6.1 | affected |
| Cisco | Cisco IOS XE Software | 17.6.2 | affected |
| Cisco | Cisco IOS XE Software | 17.6.1w | affected |
| Cisco | Cisco IOS XE Software | 17.6.1a | affected |
| Cisco | Cisco IOS XE Software | 17.6.1x | affected |
| Cisco | Cisco IOS XE Software | 17.6.3 | affected |
| Cisco | Cisco IOS XE Software | 17.6.1y | affected |
| Cisco | Cisco IOS XE Software | 17.6.1z | affected |
| Cisco | Cisco IOS XE Software | 17.6.3a | affected |
| Cisco | Cisco IOS XE Software | 17.6.4 | affected |
| Cisco | Cisco IOS XE Software | 17.6.1z1 | affected |
| Cisco | Cisco IOS XE Software | 17.6.5 | affected |
| Cisco | Cisco IOS XE Software | 17.6.6 | affected |
| Cisco | Cisco IOS XE Software | 17.6.6a | affected |
| Cisco | Cisco IOS XE Software | 17.6.5a | affected |
| Cisco | Cisco IOS XE Software | 17.6.7 | affected |
| Cisco | Cisco IOS XE Software | 17.7.1 | affected |
| Cisco | Cisco IOS XE Software | 17.7.1a | affected |
| Cisco | Cisco IOS XE Software | 17.7.1b | affected |
| Cisco | Cisco IOS XE Software | 17.7.2 | affected |
| Cisco | Cisco IOS XE Software | 17.10.1 | affected |
| Cisco | Cisco IOS XE Software | 17.10.1a | affected |
| Cisco | Cisco IOS XE Software | 17.10.1b | affected |
| Cisco | Cisco IOS XE Software | 17.8.1 | affected |
| Cisco | Cisco IOS XE Software | 17.8.1a | affected |
| Cisco | Cisco IOS XE Software | 17.9.1 | affected |
| Cisco | Cisco IOS XE Software | 17.9.1w | affected |
| Cisco | Cisco IOS XE Software | 17.9.2 | affected |
| Cisco | Cisco IOS XE Software | 17.9.1a | affected |
| Cisco | Cisco IOS XE Software | 17.9.1x | affected |
| Cisco | Cisco IOS XE Software | 17.9.1y | affected |
| Cisco | Cisco IOS XE Software | 17.9.3 | affected |
| Cisco | Cisco IOS XE Software | 17.9.2a | affected |
| Cisco | Cisco IOS XE Software | 17.9.1x1 | affected |
| Cisco | Cisco IOS XE Software | 17.9.3a | affected |
| Cisco | Cisco IOS XE Software | 17.9.4 | affected |
| Cisco | Cisco IOS XE Software | 17.9.1y1 | affected |
| Cisco | Cisco IOS XE Software | 17.9.5 | affected |
| Cisco | Cisco IOS XE Software | 17.9.4a | affected |
| Cisco | Cisco IOS XE Software | 17.9.5a | affected |
| Cisco | Cisco IOS XE Software | 17.9.5b | affected |
| Cisco | Cisco IOS XE Software | 17.9.5e | affected |
| Cisco | Cisco IOS XE Software | 17.9.5f | affected |
| Cisco | Cisco IOS XE Software | 17.11.1 | affected |
| Cisco | Cisco IOS XE Software | 17.11.1a | affected |
| Cisco | Cisco IOS XE Software | 17.12.1 | affected |
| Cisco | Cisco IOS XE Software | 17.12.1w | affected |
| Cisco | Cisco IOS XE Software | 17.12.1a | affected |
| Cisco | Cisco IOS XE Software | 17.12.1x | affected |
| Cisco | Cisco IOS XE Software | 17.12.2 | affected |
| Cisco | Cisco IOS XE Software | 17.12.3 | affected |
| Cisco | Cisco IOS XE Software | 17.12.2a | affected |
| Cisco | Cisco IOS XE Software | 17.12.1y | affected |
| Cisco | Cisco IOS XE Software | 17.12.1z | affected |
| Cisco | Cisco IOS XE Software | 17.12.3a | affected |
| Cisco | Cisco IOS XE Software | 17.12.1z1 | affected |
| Cisco | Cisco IOS XE Software | 17.13.1 | affected |
| Cisco | Cisco IOS XE Software | 17.13.1a | affected |
| Cisco | Cisco IOS XE Software | 17.14.1 | affected |
| Cisco | Cisco IOS XE Software | 17.14.1a | affected |
| Cisco | Cisco IOS XE Software | 17.11.99SW | affected |
Weaknesses
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.