PT-2025-39306 · Cisco · Cisco Ios Xe

Published 2025-09-24 · Updated 2025-11-14 · CVE-2025-20338

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A flaw exists in the Command Line Interface (CLI) of Cisco IOS XE Software that could allow a local attacker with administrative privileges to execute arbitrary commands as root on the affected device. This is due to inadequate validation of user-supplied arguments passed to specific CLI commands. An attacker must first log in to the device CLI with valid administrative credentials (level 15) and then use specially crafted commands at the CLI prompt to exploit this issue. A successful exploit could grant the attacker the ability to execute commands with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-141

Related Identifiers

BDU:2025-11715

CVE-2025-20338

Affected Products

Cisco Ios Xe

References · 9

• https://bdu.fstec.ru/vul/2025-11715 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-arg-inject-EyDDbh4e · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20338 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20338 · Security Note
• https://twitter.com/CVEnew/status/1970906978021957974 · Twitter Post
• https://t.me/CVEtracker/33267 · Telegram Post
• https://t.me/cveNotify/142890 · Telegram Post
• https://twitter.com/0dayPublishing/status/1970903564894540285 · Twitter Post
• https://twitter.com/leftSECURE/status/1971300024782111038 · Twitter Post