Product:
Cisco IOS XE Software
Summary
Multiple vulnerabilities in Cisco IOS XE Software could allow an authenticated local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust. These vulnerabilities are due to path traversal and improper image integrity validation. A successful exploit could allow the attacker to execute persistent code on the underlying operating system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2025-20313 |
Exploitation
To exploit these vulnerabilities, an attacker must have either authenticated access with level-15 privileges or physical access to the device. By leveraging path traversal and improper image integrity validation, the attacker can manipulate the device’s boot process to execute malicious code, thereby bypassing critical security features.
Affected Products
- Cisco IOS XE Software: Vulnerable to multiple security issues that could allow unauthorized code execution.
Mitigation
Cisco recommends applying the latest security updates to mitigate these vulnerabilities. Users should ensure that their devices are configured securely and monitor for any unauthorized access attempts.