CVE-2025-20334

A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by authenticating to an affected system and performing an API call with crafted input. Alternatively, an unauthenticated attacker could persuade a legitimate user with administrative privileges who is currently logged in to the system to click a crafted link. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cmd-inject-rPJM8BGL

Configurations

No configuration.

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en el subsistema API HTTP de Cisco IOS XE Software podría permitir a un atacante remoto inyectar comandos que se ejecutarán con privilegios de root en el sistema operativo subyacente. Esta vulnerabilidad se debe a una validación de entrada insuficiente. Un atacante con privilegios administrativos podría explotar esta vulnerabilidad autenticándose en un sistema afectado y realizando una llamada a la API con entrada manipulada. Alternativamente, un atacante no autenticado podría persuadir a un usuario legítimo con privilegios administrativos que esté actualmente conectado al sistema para que haga clic en un enlace manipulado. Un exploit exitoso podría permitir al atacante ejecutar comandos arbitrarios como el usuario root.

Information

Published : 2025-09-24 17:15

Updated : 2026-09-26 00:10

NVD link : CVE-2025-20334

Mitre link : CVE-2025-20334

CVE.ORG link : CVE-2025-20334

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-20334", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20334", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-25T03:55:56.503647Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"status": "affected", "version": "17.9.5"}, {"status": "affected", "version": "17.9.5a"}, {"status": "affected", "version": "17.9.5b"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.9.6a"}, {"status": "affected", "version": "17.9.7"}, {"status": "affected", "version": "17.9.5e"}, {"status": "affected", "version": "17.9.5f"}, {"status": "affected", "version": "17.9.7a"}, {"status": "affected", "version": "17.9.7b"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.12.2a"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.3a"}, {"status": "affected", "version": "17.12.4a"}, {"status": "affected", "version": "17.12.5"}, {"status": "affected", "version": "17.12.4b"}, {"status": "affected", "version": "17.12.5a"}, {"status": "affected", "version": "17.12.5b"}, {"status": "affected", "version": "17.12.5c"}, {"status": "affected", "version": "17.13.1"}, {"status": "affected", "version": "17.13.1a"}, {"status": "affected", "version": "17.14.1"}, {"status": "affected", "version": "17.14.1a"}, {"status": "affected", "version": "17.15.1"}, {"status": "affected", "version": "17.15.1w"}, {"status": "affected", "version": "17.15.1a"}, {"status": "affected", "version": "17.15.2"}, {"status": "affected", "version": "17.15.1b"}, {"status": "affected", "version": "17.15.1x"}, {"status": "affected", "version": "17.15.1z"}, {"status": "affected", "version": "17.15.2c"}, {"status": "affected", "version": "17.15.2a"}, {"status": "affected", "version": "17.15.1y"}, {"status": "affected", "version": "17.15.2b"}, {"status": "affected", "version": "17.16.1"}, {"status": "affected", "version": "17.16.1a"}]}]}], "published": "2025-09-24T17:15:40.337", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cmd-inject-rPJM8BGL", "source": "psirt@cisco.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system.\r\n\r This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by authenticating to an affected system and performing an API call with crafted input. Alternatively, an unauthenticated attacker could persuade a legitimate user with administrative privileges who is currently logged in to the system to click a crafted link. A successful exploit could allow the attacker to execute arbitrary commands as the root user."}, {"lang": "es", "value": "Una vulnerabilidad en el subsistema API HTTP de Cisco IOS XE Software podr\u00eda permitir a un atacante remoto inyectar comandos que se ejecutar\u00e1n con privilegios de root en el sistema operativo subyacente. Esta vulnerabilidad se debe a una validaci\u00f3n de entrada insuficiente. Un atacante con privilegios administrativos podr\u00eda explotar esta vulnerabilidad autentic\u00e1ndose en un sistema afectado y realizando una llamada a la API con entrada manipulada. Alternativamente, un atacante no autenticado podr\u00eda persuadir a un usuario leg\u00edtimo con privilegios administrativos que est\u00e9 actualmente conectado al sistema para que haga clic en un enlace manipulado. Un exploit exitoso podr\u00eda permitir al atacante ejecutar comandos arbitrarios como el usuario root."}], "lastModified": "2026-09-26T00:10:00.127", "sourceIdentifier": "psirt@cisco.com"}