{"id":"CVE-2025-20149","title":"A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.\r\n\r This vulnera…","summary":"A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.\r\n\r This vulnera…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cwe":["CWE-120"],"vendor":"cisco","product":"ios","affected":["ios = 15.0(1)ex","ios = 15.0(2)ea","ios = 15.0(2)ea1","ios = 15.0(2)ej","ios = 15.0(2)ej1","ios = 15.0(2)ek","ios = 15.0(2)ek1","ios = 15.0(2)ex","ios = 15.0(2)ex1","ios = 15.0(2)ex2","ios = 15.0(2)ex3","ios = 15.0(2)ex4","ios = 15.0(2)ex5","ios = 15.0(2)ex8","ios = 15.0(2)ex10","ios = 15.0(2)ex11","ios = 15.0(2)ex12","ios = 15.0(2)ex13","ios = 15.0(2)ey","ios = 15.0(2)ey1","ios = 15.0(2)ey2","ios = 15.0(2)ey3","ios = 15.0(2)ez","ios = 15.0(2)se","ios = 15.0(2)se1","ios = 15.0(2)se2","ios = 15.0(2)se3","ios = 15.0(2)se4","ios = 15.0(2)se5","ios = 15.0(2)se6","ios = 15.0(2)se7","ios = 15.0(2)se8","ios = 15.0(2)se9","ios = 15.0(2)se10","ios = 15.0(2)se10a","ios = 15.0(2)se11","ios = 15.0(2)se12","ios = 15.0(2)se13","ios = 15.0(2a)ex5","ios = 15.1(1)sg","ios = 15.1(1)sg1","ios = 15.1(1)sg2","ios = 15.1(1)sy","ios = 15.1(1)sy1","ios = 15.1(1)sy2","ios = 15.1(1)sy3","ios = 15.1(1)sy4","ios = 15.1(1)sy5","ios = 15.1(1)sy6","ios = 15.1(2)s","ios = 15.1(2)s1","ios = 15.1(2)s2","ios = 15.1(2)sg","ios = 15.1(2)sg1","ios = 15.1(2)sg2","ios = 15.1(2)sg3","ios = 15.1(2)sg4","ios = 15.1(2)sg5","ios = 15.1(2)sg6","ios = 15.1(2)sg7","ios = 15.1(2)sg8","ios = 15.1(2)sy","ios = 15.1(2)sy1","ios = 15.1(2)sy2","ios = 15.1(2)sy3","ios = 15.1(2)sy4","ios = 15.1(2)sy4a","ios = 15.1(2)sy5","ios = 15.1(2)sy6","ios = 15.1(2)sy7","ios = 15.1(2)sy8","ios = 15.1(2)sy9","ios = 15.1(2)sy10","ios = 15.1(2)sy11","ios = 15.1(2)sy12","ios = 15.1(2)sy13","ios = 15.1(2)sy14","ios = 15.1(2)sy15","ios = 15.1(2)sy16","ios = 15.1(3)mra","ios = 15.1(3)mra1","ios = 15.1(3)mra2","ios = 15.1(3)mra3","ios = 15.1(3)mra4","ios = 15.1(3)s","ios = 15.1(3)s0a","ios = 15.1(3)s1","ios = 15.1(3)s2","ios = 15.1(3)s3","ios = 15.1(3)s4","ios = 15.1(3)s5","ios = 15.1(3)s5a","ios = 15.1(3)s6","ios = 15.1(3)svb1","ios = 15.1(3)svb2","ios = 15.1(3)svd","ios = 15.1(3)svd1","ios = 15.1(3)svd2","ios = 15.1(3)sve","ios = 15.1(3)svf"],"published":"2025-09-24","updated":"2026-09-18","sourceUpdated":"2026-09-18T13:18:49.167","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-20149","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-cli-EB7cZ6yO","label":"psirt@cisco.com"}],"tags":["nvd"],"epss":0.0012,"epssPercentile":0.02124,"ingestedAt":"2026-09-18T12:40:48.880Z","slug":"CVE-2025-20149","body":"## Overview\n\nA vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.\r\n\r This vulnerability is due to a buffer overflow. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.\n\n## Affected\n\n- `ios = 15.0(1)ex`\n- `ios = 15.0(2)ea`\n- `ios = 15.0(2)ea1`\n- `ios = 15.0(2)ej`\n- `ios = 15.0(2)ej1`\n- `ios = 15.0(2)ek`\n- `ios = 15.0(2)ek1`\n- `ios = 15.0(2)ex`\n- `ios = 15.0(2)ex1`\n- `ios = 15.0(2)ex2`\n- `ios = 15.0(2)ex3`\n- `ios = 15.0(2)ex4`\n- `ios = 15.0(2)ex5`\n- `ios = 15.0(2)ex8`\n- `ios = 15.0(2)ex10`\n- `ios = 15.0(2)ex11`\n- `ios = 15.0(2)ex12`\n- `ios = 15.0(2)ex13`\n- `ios = 15.0(2)ey`\n- `ios = 15.0(2)ey1`\n- `ios = 15.0(2)ey2`\n- `ios = 15.0(2)ey3`\n- `ios = 15.0(2)ez`\n- `ios = 15.0(2)se`\n- `ios = 15.0(2)se1`\n- `ios = 15.0(2)se2`\n- `ios = 15.0(2)se3`\n- `ios = 15.0(2)se4`\n- `ios = 15.0(2)se5`\n- `ios = 15.0(2)se6`\n- `ios = 15.0(2)se7`\n- `ios = 15.0(2)se8`\n- `ios = 15.0(2)se9`\n- `ios = 15.0(2)se10`\n- `ios = 15.0(2)se10a`\n- `ios = 15.0(2)se11`\n- `ios = 15.0(2)se12`\n- `ios = 15.0(2)se13`\n- `ios = 15.0(2a)ex5`\n- `ios = 15.1(1)sg`\n- `ios = 15.1(1)sg1`\n- `ios = 15.1(1)sg2`\n- `ios = 15.1(1)sy`\n- `ios = 15.1(1)sy1`\n- `ios = 15.1(1)sy2`\n- `ios = 15.1(1)sy3`\n- `ios = 15.1(1)sy4`\n- `ios = 15.1(1)sy5`\n- `ios = 15.1(1)sy6`\n- `ios = 15.1(2)s`\n- `ios = 15.1(2)s1`\n- `ios = 15.1(2)s2`\n- `ios = 15.1(2)sg`\n- `ios = 15.1(2)sg1`\n- `ios = 15.1(2)sg2`\n- `ios = 15.1(2)sg3`\n- `ios = 15.1(2)sg4`\n- `ios = 15.1(2)sg5`\n- `ios = 15.1(2)sg6`\n- `ios = 15.1(2)sg7`\n- `ios = 15.1(2)sg8`\n- `ios = 15.1(2)sy`\n- `ios = 15.1(2)sy1`\n- `ios = 15.1(2)sy2`\n- `ios = 15.1(2)sy3`\n- `ios = 15.1(2)sy4`\n- `ios = 15.1(2)sy4a`\n- `ios = 15.1(2)sy5`\n- `ios = 15.1(2)sy6`\n- `ios = 15.1(2)sy7`\n- `ios = 15.1(2)sy8`\n- `ios = 15.1(2)sy9`\n- `ios = 15.1(2)sy10`\n- `ios = 15.1(2)sy11`\n- `ios = 15.1(2)sy12`\n- `ios = 15.1(2)sy13`\n- `ios = 15.1(2)sy14`\n- `ios = 15.1(2)sy15`\n- `ios = 15.1(2)sy16`\n- `ios = 15.1(3)mra`\n- `ios = 15.1(3)mra1`\n- `ios = 15.1(3)mra2`\n- `ios = 15.1(3)mra3`\n- `ios = 15.1(3)mra4`\n- `ios = 15.1(3)s`\n- `ios = 15.1(3)s0a`\n- `ios = 15.1(3)s1`\n- `ios = 15.1(3)s2`\n- `ios = 15.1(3)s3`\n- `ios = 15.1(3)s4`\n- `ios = 15.1(3)s5`\n- `ios = 15.1(3)s5a`\n- `ios = 15.1(3)s6`\n- `ios = 15.1(3)svb1`\n- `ios = 15.1(3)svb2`\n- `ios = 15.1(3)svd`\n- `ios = 15.1(3)svd1`\n- `ios = 15.1(3)svd2`\n- `ios = 15.1(3)sve`\n- `ios = 15.1(3)svf`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}