CVE-2025-20338: cisco cisco ios xe software

Vulnerability summary

CVE-2025-20338 is a medium (CVSS 6.7) vulnerability in cisco cisco ios xe software. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.9% of scored vulnerabilities.

Timeline

1. 24-09-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by logging in to the device CLI with valid administrative (level 15) credentials and using crafted commands at the CLI prompt. A successful exploit could allow the attacker to execute arbitrary commands as root.

• CWE-141Improper Neutralization of Parameter/Argument DelimitersThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.