CVE-2025-20198: vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device
This Cisco advisory covers CVE-2025-20198 in IOS XE Software.
- CVE-2025-20198
Key facts
- Vendor rating
- Medium, CVSS 4.6
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N· base score 4.6, scored by ciscoAttack vector: local. Attack complexity: low. Privileges required: high. User interaction: none. Scope: changed. Confidentiality impact: low. Integrity impact: low. Availability impact: none.- Weakness
- CWE-754 Improper Check for Unusual or Exceptional Conditions
- CISA SSVC
- Exploitation: none observed. Automatable: no. Technical impact: total. CISA, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Scope: These vulnerabilities affect Cisco products if they are running a vulnerable release of Cisco IOS XE Software, regardless of device configuration.
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Multiple vulnerabilities in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device. These vulnerabilities are due to insufficient input validation when processing specific configuration commands.
An attacker could exploit these vulnerabilities by including crafted input in specific configuration commands.
Text from the source record.
- Scope: These vulnerabilities affect Cisco products if they are running a vulnerable release of Cisco IOS XE Software, regardless of device configuration.
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2025-20198
Workaround status
- There are no workarounds that address these vulnerabilities.
End-of-life dates for Cisco IOS XE
More Cisco advisories
CVE-2026-20267Aug 5, 2026Cisco IOS XE Software Security Hardening Release: August 2026CVE-2025-20338Sep 24, 2025IOS XE Software command injectionCVE-2026-76506Nov 4, 2026Cisco UCS Central Software Remote Code Execution VulnerabilityCVE-2026-20241Nov 4, 2026Cisco Identity Services Engine Authorization Bypass VulnerabilityCVE-2026-76419Nov 4, 2026Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCVE-2026-76418Oct 28, 2026Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
Get an email when Cisco IOS XE publishes the next one.
See Cisco IOS XE's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
