Unauthorized Access in Cisco IOS Software HTTP Server Feature

CVE-2026-20125

What is CVE-2026-20125?

A vulnerability exists in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software that can allow an authenticated remote attacker to trigger a device reload. This issue arises from improper validation of user input, enabling an attacker to send malformed HTTP requests. If successfully exploited, this could cause a watchdog timer to expire and the device to reload, leading to a denial of service. It is important that organizations using the affected software implement necessary security measures as attackers require a valid user account to exploit this vulnerability.

References