Product:
IOS XE Software
Summary
A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, leading to a denial of service (DoS) condition. This issue arises from improper handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets. An attacker can exploit this vulnerability by sending these malformed packets through an affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.6 | CVE-2025-20315 |
Exploitation
To exploit this vulnerability, an attacker needs to send specially crafted malformed CAPWAP packets to an affected device. If successful, this could trigger an unexpected reload of the device, resulting in a denial of service condition. The attack does not require any authentication or special privileges, making it relatively easy for an attacker to execute.
Affected Products
- IOS XE Software: Vulnerable due to improper handling of CAPWAP packets, leading to potential device reloads.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco for the affected IOS XE Software. Additionally, network administrators should implement strict access controls and monitor network traffic for any unusual CAPWAP packet activity.