PT-2025-20268 · Cisco · Cisco Ios Xe+2

Michael Deviveiros · Published 2025-05-07 · Updated 2025-07-11 · CVE-2025-20196

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco IOS Software and Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the Cisco IOx application hosting environment could allow an unauthenticated, remote attacker to cause the environment to stop responding, resulting in a denial of service (DoS) condition. This is due to the improper handling of HTTP requests. An attacker could exploit this by sending crafted HTTP requests to an affected device, causing the environment to stop responding. The IOx process will need to be manually restarted to recover services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-20196

Affected Products

Cisco Ios

Cisco Ios Xe

Cisco Iox

References · 7

• https://osv.dev/vulnerability/CVE-2025-20196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20196 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-dos-95Fqnf7b · Vendor Advisory
• https://t.me/cvenotify/128545 · Telegram Post
• https://t.me/cvetracker/23271 · Telegram Post
• https://twitter.com/syedaquib77/status/1920177320717127894 · Twitter Post
• https://twitter.com/CVEnew/status/1920246402476638514 · Twitter Post