PT-2025-20267 · Cisco · Cisco Ios Xe

CVE-2025-20195 · Publicado 2025-05-07 · Atualizado 2025-07-11

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to perform a CSRF attack and execute commands on the CLI of an affected device. This issue is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this by persuading an already authenticated user to follow a crafted link. A successful exploit could allow the attacker to clear logs, such as syslog, parser, and licensing logs, on the affected device if the targeted user has privileges to clear those logs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2025-10324

CVE-2025-20195

Produtos afetados

Cisco Ios Xe

Referências · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-multi-ARNHM4v6 · Aviso do Fabricante
• https://t.me/cvetracker/23270 · Publicação no Telegram
• https://t.me/cvenotify/128555 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1920246393156804823 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-20195 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-10324 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-20195 · Aviso do Fabricante