Product:
Cisco IOS XE Software
Summary
A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by authenticating to an affected system and performing an API call with crafted input.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-20334 |
Exploitation
An attacker with administrative privileges can exploit this vulnerability by authenticating to the affected system and making an API call with specially crafted input. Alternatively, an unauthenticated attacker could trick a legitimate user with administrative privileges into clicking a malicious link, leading to command execution with root privileges.
Affected Products
- Cisco IOS XE Software: Affected by the HTTP API vulnerability allowing command injection.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco. Additionally, ensure that administrative access is restricted and monitor API calls for any suspicious activity.