CVE-2025-20164: vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate privileges
This Cisco advisory covers CVE-2025-20164 in IOS.
- CVE-2025-20164
Key facts
- Vendor rating
- High, CVSS 8.3
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H· base score 8.3, scored by ciscoAttack vector: network. Attack complexity: low. Privileges required: low. User interaction: none. Scope: unchanged. Confidentiality impact: low. Integrity impact: high. Availability impact: high.- Weakness
- CWE-862 Missing Authorization
- CISA SSVC
- Exploitation: none observed. Automatable: no. Technical impact: total. CISA, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Scope: This vulnerability affects the following Cisco Industrial Ethernet Series Switches if they are running a vulnerable release of Cisco IOS Software and have HTTP enabled:
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate privileges. The flaw is caused by insufficient validation of authorizations for authenticated users.
Text from the source record.
- Scope: This vulnerability affects the following Cisco Industrial Ethernet Series Switches if they are running a vulnerable release of Cisco IOS Software and have HTTP enabled:
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2025-20164
Workarounds
- There are no workarounds that address this vulnerability. However, there is a mitigation.
- Disabling the HTTP Server feature eliminates the attack vector for this vulnerability and may be a suitable mitigation until affected devices can be upgraded. To disable the HTTP Server feature, use the no ip http server or no ip http secure-server command in global configuration mode. If both the HTTP server and HTTPS server are in use, both commands are required to disable the HTTP Server fea…
More Cisco advisories
CVE-2026-76506Nov 4, 2026Cisco UCS Central Software Remote Code Execution VulnerabilityCVE-2026-20241Nov 4, 2026Cisco Identity Services Engine Authorization Bypass VulnerabilityCVE-2026-76419Nov 4, 2026Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCVE-2026-76418Oct 28, 2026Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseCVE-2026-20241Oct 28, 2026Cisco Advance Notification for Publication of November 4, 2026, Security AdvisoriesCVE-2026-105482Oct 27, 2026Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
Get an email when Cisco publishes the next one.
See Cisco's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
