Product:
Catalyst 9000 Series Switches
Summary
A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic. This vulnerability is due to improper handling of crafted Ethernet frames. A successful exploit could lead to a denial of service condition.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.4 | CVE-2025-20311 |
Exploitation
An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. By doing so, the attacker can cause the egress port to which the crafted frame is forwarded to start dropping all frames, effectively blocking outbound traffic and resulting in a denial of service.
Affected Products
- Catalyst 9000 Series Switches: Vulnerable to crafted Ethernet frames causing egress port blockage.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco for the affected products. Additionally, network segmentation and monitoring can help detect and prevent exploitation attempts.