Logic Error in IPv6 Packet Processing Affects Cisco Access Point Software
CVE-2025-20365

4.3MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Aironet Access Point Software (iOS Xe Controller)
Vendor
CVE Published:
24 September 2025

Badges

👾 Exploit Exists

What is CVE-2025-20365?

A logic error in the IPv6 Router Advertisement packet processing in Cisco Access Point Software enables unauthenticated, adjacent attackers to alter the IPv6 gateway settings on the device. By associating with a vulnerable wireless network and sending specially crafted IPv6 RA packets, an attacker can exploit this flaw to change the IPv6 gateway temporarily, potentially causing intermittent packet loss for users connected to the affected access point.

Affected Version(s)

Cisco Aironet Access Point Software (IOS XE Controller) 16.10.1e

Cisco Aironet Access Point Software (IOS XE Controller) 16.10.1

Cisco Aironet Access Point Software (IOS XE Controller) 17.1.1t

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-20365 : Logic Error in IPv6 Packet Processing Affects Cisco Access Point Software