CVE-2025-20364

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H

Configurations

No configuration.

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en el procesamiento de tramas de acción de Device Analytics del software de Cisco Wireless Access Point (AP) podría permitir a un atacante no autenticado y adyacente inyectar tramas de acción inalámbricas 802.11 con información arbitraria. Esta vulnerabilidad se debe a comprobaciones de verificación insuficientes de las tramas de acción 802.11 entrantes. Un atacante podría explotar esta vulnerabilidad enviando tramas de acción 802.11 de Device Analytics con parámetros arbitrarios. Un exploit exitoso podría permitir al atacante inyectar tramas de acción de Device Analytics con información arbitraria, lo que podría modificar los datos de Device Analytics de clientes inalámbricos válidos que están conectados al mismo controlador inalámbrico.

Information

Published : 2025-09-24 17:15

Updated : 2026-09-26 00:10

NVD link : CVE-2025-20364

Mitre link : CVE-2025-20364

CVE.ORG link : CVE-2025-20364

JSON object : View

Products Affected

No product.

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2025-20364", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20364", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-15T16:05:06.927564Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Aironet Access Point Software (IOS XE Controller)", "versions": [{"status": "affected", "version": "16.10.1e"}, {"status": "affected", "version": "16.10.1"}, {"status": "affected", "version": "17.1.1t"}, {"status": "affected", "version": "17.1.1s"}, {"status": "affected", "version": "17.1.1"}, {"status": "affected", "version": "16.11.1a"}, {"status": "affected", "version": "16.11.1"}, {"status": "affected", "version": "16.11.1c"}, {"status": "affected", "version": "16.11.1b"}, {"status": "affected", "version": "16.12.1s"}, {"status": "affected", "version": "16.12.4"}, {"status": "affected", "version": "16.12.1"}, {"status": "affected", "version": "16.12.2s"}, {"status": "affected", "version": "16.12.1t"}, {"status": "affected", "version": "16.12.4a"}, {"status": "affected", "version": "16.12.5"}, {"status": "affected", "version": "16.12.3"}, {"status": "affected", "version": "16.12.6"}, {"status": "affected", "version": "16.12.8"}, {"status": "affected", "version": "16.12.7"}, {"status": "affected", "version": "16.12.6a"}, {"status": "affected", "version": "17.3.1"}, {"status": "affected", "version": "17.3.2a"}, {"status": "affected", "version": "17.3.3"}, {"status": "affected", "version": "17.3.4"}, {"status": "affected", "version": "17.3.5"}, {"status": "affected", "version": "17.3.2"}, {"status": "affected", "version": "17.3.4c"}, {"status": "affected", "version": "17.3.5a"}, {"status": "affected", "version": "17.3.5b"}, {"status": "affected", "version": "17.3.6"}, {"status": "affected", "version": "17.3.7"}, {"status": "affected", "version": "17.3.8"}, {"status": "affected", "version": "17.3.8a"}, {"status": "affected", "version": "17.2.1"}, {"status": "affected", "version": "17.2.1a"}, {"status": "affected", "version": "17.2.3"}, {"status": "affected", "version": "17.2.2"}, {"status": "affected", "version": "17.5.1"}, {"status": "affected", "version": "17.4.1"}, {"status": "affected", "version": "17.6.1"}, {"status": "affected", "version": "17.6.2"}, {"status": "affected", "version": "17.6.3"}, {"status": "affected", "version": "17.6.4"}, {"status": "affected", "version": "17.6.5"}, {"status": "affected", "version": "17.6.6"}, {"status": "affected", "version": "17.6.6a"}, {"status": "affected", "version": "17.6.5a"}, {"status": "affected", "version": "17.6.7"}, {"status": "affected", "version": "17.6.8"}, {"status": "affected", "version": "17.10.1"}, {"status": "affected", "version": "17.9.1"}, {"status": "affected", "version": "17.9.2"}, {"status": "affected", "version": "17.9.3"}, {"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.9.5"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.7.1"}, {"status": "affected", "version": "17.8.1"}, {"status": "affected", "version": "17.11.1"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.12.3"}, {"status": "affected", "version": "17.12.4"}, {"status": "affected", "version": "17.12.5"}, {"status": "affected", "version": "17.13.1"}, {"status": "affected", "version": "17.14.1"}, {"status": "affected", "version": "17.15.1"}, {"status": "affected", "version": "17.15.3"}]}]}], "published": "2025-09-24T17:15:40.703", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H", "source": "psirt@cisco.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information.\r\n\r This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller."}, {"lang": "es", "value": "Una vulnerabilidad en el procesamiento de tramas de acci\u00f3n de Device Analytics del software de Cisco Wireless Access Point (AP) podr\u00eda permitir a un atacante no autenticado y adyacente inyectar tramas de acci\u00f3n inal\u00e1mbricas 802.11 con informaci\u00f3n arbitraria. Esta vulnerabilidad se debe a comprobaciones de verificaci\u00f3n insuficientes de las tramas de acci\u00f3n 802.11 entrantes. Un atacante podr\u00eda explotar esta vulnerabilidad enviando tramas de acci\u00f3n 802.11 de Device Analytics con par\u00e1metros arbitrarios. Un exploit exitoso podr\u00eda permitir al atacante inyectar tramas de acci\u00f3n de Device Analytics con informaci\u00f3n arbitraria, lo que podr\u00eda modificar los datos de Device Analytics de clientes inal\u00e1mbricos v\u00e1lidos que est\u00e1n conectados al mismo controlador inal\u00e1mbrico."}], "lastModified": "2026-09-26T00:10:00.127", "sourceIdentifier": "psirt@cisco.com"}