Injection Vulnerability in Cisco IOS XE Web Management Interface

CVE-2025-20194

What is CVE-2025-20194?

A security weakness exists within the web-based management interface of Cisco IOS XE Software. This flaw allows authenticated, low-privileged attackers to conduct injection attacks by exploiting insufficient input validation. Attackers could potentially send specially crafted inputs to compromise the device, enabling them to access limited files from the operating system or to manipulate syslog and licensing logs. Addressing this vulnerability is crucial to protect the integrity of the affected devices.

References