PT-2025-20267 · Cisco · Cisco Ios Xe

Published 2025-05-07 · Updated 2025-07-11 · CVE-2025-20195

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to perform a CSRF attack and execute commands on the CLI of an affected device. This issue is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this by persuading an already authenticated user to follow a crafted link. A successful exploit could allow the attacker to clear logs, such as syslog, parser, and licensing logs, on the affected device if the targeted user has privileges to clear those logs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2025-10324

CVE-2025-20195

Affected Products

Cisco Ios Xe

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-multi-ARNHM4v6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20195 · Security Note
• https://bdu.fstec.ru/vul/2025-10324 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20195 · Vendor Advisory
• https://t.me/cvetracker/23270 · Telegram Post
• https://t.me/cvenotify/128555 · Telegram Post
• https://twitter.com/CVEnew/status/1920246393156804823 · Twitter Post