This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes 35 vulnerabilities in its products

Cisco fixes 35 vulnerabilities in its products. The most severe are described below; the remaining vulnerabilities can be found at [1]. Vulnerable products and their fixed versions can be found in the link provided for each vulnerability.

Cisco IOS XE Software - arbitrary file upload (CVE-2025-20188)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can, due to the presence of a hard-coded JSON Web Token on the affected system, upload arbitrary files, perform path traversal and execute arbitrary commands with root privileges by sending crafted HTTPS requests to the AP image download interface [2].

The vulnerability is present in product:

  • *:Cisco IOS XE;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 5. 2025.

Cisco IOS XE Software - DoS (CVE-2025-20140)
CVSS 7.4 (High)

An unauthenticated attacker on the local network can, due to incorrect memory management in the Wireless Network Control daemon in Cisco IOS XE software, overload the system by sending a series of network requests over IPv6 from a connected wireless client and thereby cause a denial-of-service condition [3].

The vulnerability is present in product:

  • *:Cisco IOS XE Software;

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 7. 5. 2025.

Cisco IOS XE Software - command injection (CVE-2025-20186)
CVSS 8.8 (High)

An authenticated remote attacker with a "lobby ambassador" user account can, due to insufficient input validation in the web management interface of the Wireless LAN Controller feature in Cisco IOS XE software, inject commands on the affected device [4].

The vulnerability is present in product:

  • *:Cisco IOS XE Software;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-20186 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 5. 2025.

Cisco IOS, IOS XE, and IOS XR Software - DoS (CVE-2025-20154)
CVSS 8.6 (High)

An unauthenticated remote attacker can, due to an out-of-bounds access when processing specially crafted TWAMP control packets in Cisco IOS and Cisco IOS XE software, cause the affected device to restart and thereby trigger a denial-of-service condition [5].

The vulnerability is present in products:

  • *:Cisco IOS Software;
  • *:Cisco IOS XE Software;
  • *:Cisco IOS XR Software; <24.3.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 7. 5. 2025.

Cisco Catalyst SD-WAN Manager - privilege escalation (CVE-2025-20122)
CVSS 7.8 (High)

An authenticated local attacker with read-only privileges can, due to insufficient input validation in the command-line interface of Cisco Catalyst SD-WAN Manager, escalate their privileges to root on the underlying operating system by sending a specially crafted request [6].

The vulnerability is present in product:

  • *:Cisco Catalyst SD-WAN Manager; <20.16.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 5. 2025.

Cisco Catalyst Center - unauthenticated API access (CVE-2025-20210)
CVSS 7.3 (High)

An unauthenticated remote attacker can, due to missing authentication on one of the API endpoints in the management interface of Cisco Catalyst Center, read and modify the outbound proxy configuration settings and thereby enable interception of outbound internet traffic [7].

The vulnerability is present in product:

  • *:Cisco Catalyst Center; <2.3.7.9

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

More information:

The vulnerability was publicly disclosed 7. 5. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 13. 5. 2025.

CESNET, z.s.p.o. Logo