Privilege Escalation in Cisco IOS XE Software

CVE-2025-20201

Summary

A vulnerability exists in the command-line interface (CLI) of Cisco IOS XE Software that could be exploited by an authenticated local attacker with privilege level 15 to escalate privileges to root on the underlying operating system. This issue stems from insufficient input validation during the processing of specific configuration commands. By crafting and including malicious input in these commands, an attacker could successfully elevate their access, gaining control over the underlying OS and potentially executing undetected actions. Attackers must have administrative privileges to access the configuration mode of the affected device.

References