Cisco Security Updates – 25 September 2025

The addressed vulnerabilities could allow the attacker to perform denial of service attacks, conduct cross-site scripting attacks, obtain sensitive information, bypass security restrictions, or execute arbitrary commands and gain access to the affected product.

Sample of addressed vulnerabilities:

1. Cisco IOS XE Software HTTP API Command Injection Vulnerability (CVE-2025- 20334):

• CVSS: 8.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Consequences: Gain Access

2. Cisco IOS XE Software Network-Based Application Recognition Denial of Service Vulnerability (CVE-2025-20315):

• CVSS: 8.6
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Denial of Service

Sample of the affected products:

• Cisco IOS XE Software.
• Catalyst SD-WAN Manager.
• IOS XE SD-WAN Software.
• NX-OS Software.
• IOS XR Software.
• Cisco Industrial Ethernet.

It should be highlighted that Cisco is aware of a proof-of-concept (PoC) exploit that exists in the wild for vulnerabilities “CVE-2025-20221”, “CVE-2025-20149”, and “CVE-2025-20240”. Also, Cisco is aware that the vulnerability “CVE-2025-20352” is being exploited in the wild after local Administrator credentials were compromised.