Command Injection Vulnerability in Cisco IOS XE Software

CVE-2025-20338

What is CVE-2025-20338?

A command injection vulnerability exists in the CLI of Cisco IOS XE Software, allowing an authenticated local attacker with administrative privileges to execute arbitrary commands on the underlying operating system. This issue arises from inadequate validation of user arguments within specific CLI commands. By leveraging valid administrative credentials and crafting specific commands, an attacker could potentially gain root access and execute malicious commands, compromising system integrity.

References