Product:
Cisco IOS XE Software
Summary
A vulnerability in Cisco IOS XE Software could allow an authenticated local attacker with level-15 privileges or an unauthenticated attacker with physical access to execute persistent code at boot time and break the chain of trust. This vulnerability is due to improper validation of software packages. A successful exploit could allow the attacker to execute persistent code on the underlying operating system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2025-20314 |
Exploitation
An attacker could exploit this vulnerability by placing a crafted file into a specific location on an affected device. This requires either level-15 privileges or physical access to the device. Once the crafted file is in place, the attacker can execute persistent code during the boot process, effectively bypassing critical security features.
Affected Products
- Cisco IOS XE Software: Affected by the vulnerability allowing execution of persistent code.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that only trusted users have physical access to devices and to implement strict access controls. Regularly updating the software and monitoring for unauthorized changes can also help protect against potential exploits.