Injection Vulnerability in Cisco Wireless Access Point Software
CVE-2025-20364

4.3MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Aironet Access Point Software (iOS Xe Controller)
Vendor
CVE Published:
24 September 2025

Badges

👾 Exploit Exists

What is CVE-2025-20364?

A security flaw in Cisco's Wireless Access Point Software enables an unauthenticated, adjacent attacker to inject malicious 802.11 action frames. This arises from inadequate verification of incoming frames, allowing manipulation of Device Analytics data. By exploiting this weakness, an attacker can disrupt the integrity of the data associated with legitimate wireless clients linked to the same wireless controller, potentially compromising network security.

Affected Version(s)

Cisco Aironet Access Point Software (IOS XE Controller) 16.10.1e

Cisco Aironet Access Point Software (IOS XE Controller) 16.10.1

Cisco Aironet Access Point Software (IOS XE Controller) 17.1.1t

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-20364 : Injection Vulnerability in Cisco Wireless Access Point Software