Injection Vulnerability in Cisco Web-Based Management Interface
CVE-2025-20193

6.5MEDIUM

Key Information:

Vendor
Cisco
Status
Cisco iOS Xe Software
Vendor
CVE Published:
7 May 2025

Badges

👾 Exploit Exists

Summary

A vulnerability exists in the web-based management interface of Cisco IOS XE Software, allowing an authenticated, low-privileged remote attacker to perform injection attacks. This issue stems from inadequate input validation, enabling attackers to send specially crafted input to the management interface. Successful exploitation could permit unauthorized access to read files from the underlying operating system, posing significant risks to network integrity and data security.

Affected Version(s)

Cisco IOS XE Software 17.3.1

Cisco IOS XE Software 17.3.2

Cisco IOS XE Software 17.3.3

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20193 : Injection Vulnerability in Cisco Web-Based Management Interface | SecurityVulnerability.io