Privilege Escalation in Cisco IOS XE Software Affecting Local Attackers

CVE-2025-20198

Summary

A vulnerability exists within the CLI of Cisco IOS XE Software that permits an authenticated, local user with privilege level 15 to effectively elevate their privileges to root on the underlying operating system. This flaw arises from insufficient input validation during the processing of specific configuration commands. By delivering crafted input, an attacker can exploit this weakness, thereby gaining unauthorized access to critical system functionalities. Consequently, the attacker could execute potentially undetected actions within the operating system of the compromised device.

References