---
id: CVE-2025-20149
title: "A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.\r\n\r This vulnera…"
summary: "A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.\r\n\r This vulnera…"
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'
cwe:
  - CWE-120
vendor: cisco
product: ios
affected:
  - ios = 15.0(1)ex
  - ios = 15.0(2)ea
  - ios = 15.0(2)ea1
  - ios = 15.0(2)ej
  - ios = 15.0(2)ej1
  - ios = 15.0(2)ek
  - ios = 15.0(2)ek1
  - ios = 15.0(2)ex
  - ios = 15.0(2)ex1
  - ios = 15.0(2)ex2
  - ios = 15.0(2)ex3
  - ios = 15.0(2)ex4
  - ios = 15.0(2)ex5
  - ios = 15.0(2)ex8
  - ios = 15.0(2)ex10
  - ios = 15.0(2)ex11
  - ios = 15.0(2)ex12
  - ios = 15.0(2)ex13
  - ios = 15.0(2)ey
  - ios = 15.0(2)ey1
  - ios = 15.0(2)ey2
  - ios = 15.0(2)ey3
  - ios = 15.0(2)ez
  - ios = 15.0(2)se
  - ios = 15.0(2)se1
  - ios = 15.0(2)se2
  - ios = 15.0(2)se3
  - ios = 15.0(2)se4
  - ios = 15.0(2)se5
  - ios = 15.0(2)se6
  - ios = 15.0(2)se7
  - ios = 15.0(2)se8
  - ios = 15.0(2)se9
  - ios = 15.0(2)se10
  - ios = 15.0(2)se10a
  - ios = 15.0(2)se11
  - ios = 15.0(2)se12
  - ios = 15.0(2)se13
  - ios = 15.0(2a)ex5
  - ios = 15.1(1)sg
  - ios = 15.1(1)sg1
  - ios = 15.1(1)sg2
  - ios = 15.1(1)sy
  - ios = 15.1(1)sy1
  - ios = 15.1(1)sy2
  - ios = 15.1(1)sy3
  - ios = 15.1(1)sy4
  - ios = 15.1(1)sy5
  - ios = 15.1(1)sy6
  - ios = 15.1(2)s
  - ios = 15.1(2)s1
  - ios = 15.1(2)s2
  - ios = 15.1(2)sg
  - ios = 15.1(2)sg1
  - ios = 15.1(2)sg2
  - ios = 15.1(2)sg3
  - ios = 15.1(2)sg4
  - ios = 15.1(2)sg5
  - ios = 15.1(2)sg6
  - ios = 15.1(2)sg7
  - ios = 15.1(2)sg8
  - ios = 15.1(2)sy
  - ios = 15.1(2)sy1
  - ios = 15.1(2)sy2
  - ios = 15.1(2)sy3
  - ios = 15.1(2)sy4
  - ios = 15.1(2)sy4a
  - ios = 15.1(2)sy5
  - ios = 15.1(2)sy6
  - ios = 15.1(2)sy7
  - ios = 15.1(2)sy8
  - ios = 15.1(2)sy9
  - ios = 15.1(2)sy10
  - ios = 15.1(2)sy11
  - ios = 15.1(2)sy12
  - ios = 15.1(2)sy13
  - ios = 15.1(2)sy14
  - ios = 15.1(2)sy15
  - ios = 15.1(2)sy16
  - ios = 15.1(3)mra
  - ios = 15.1(3)mra1
  - ios = 15.1(3)mra2
  - ios = 15.1(3)mra3
  - ios = 15.1(3)mra4
  - ios = 15.1(3)s
  - ios = 15.1(3)s0a
  - ios = 15.1(3)s1
  - ios = 15.1(3)s2
  - ios = 15.1(3)s3
  - ios = 15.1(3)s4
  - ios = 15.1(3)s5
  - ios = 15.1(3)s5a
  - ios = 15.1(3)s6
  - ios = 15.1(3)svb1
  - ios = 15.1(3)svb2
  - ios = 15.1(3)svd
  - ios = 15.1(3)svd1
  - ios = 15.1(3)svd2
  - ios = 15.1(3)sve
  - ios = 15.1(3)svf
published: '2025-09-24'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T13:18:49.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-20149'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-cli-EB7cZ6yO
    label: psirt@cisco.com
tags:
  - nvd
epss: 0.0012
epssPercentile: 0.02124
ingestedAt: '2026-09-18T12:40:48.880Z'
---

## Overview

A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.

 This vulnerability is due to a buffer overflow. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

## Affected

- `ios = 15.0(1)ex`
- `ios = 15.0(2)ea`
- `ios = 15.0(2)ea1`
- `ios = 15.0(2)ej`
- `ios = 15.0(2)ej1`
- `ios = 15.0(2)ek`
- `ios = 15.0(2)ek1`
- `ios = 15.0(2)ex`
- `ios = 15.0(2)ex1`
- `ios = 15.0(2)ex2`
- `ios = 15.0(2)ex3`
- `ios = 15.0(2)ex4`
- `ios = 15.0(2)ex5`
- `ios = 15.0(2)ex8`
- `ios = 15.0(2)ex10`
- `ios = 15.0(2)ex11`
- `ios = 15.0(2)ex12`
- `ios = 15.0(2)ex13`
- `ios = 15.0(2)ey`
- `ios = 15.0(2)ey1`
- `ios = 15.0(2)ey2`
- `ios = 15.0(2)ey3`
- `ios = 15.0(2)ez`
- `ios = 15.0(2)se`
- `ios = 15.0(2)se1`
- `ios = 15.0(2)se2`
- `ios = 15.0(2)se3`
- `ios = 15.0(2)se4`
- `ios = 15.0(2)se5`
- `ios = 15.0(2)se6`
- `ios = 15.0(2)se7`
- `ios = 15.0(2)se8`
- `ios = 15.0(2)se9`
- `ios = 15.0(2)se10`
- `ios = 15.0(2)se10a`
- `ios = 15.0(2)se11`
- `ios = 15.0(2)se12`
- `ios = 15.0(2)se13`
- `ios = 15.0(2a)ex5`
- `ios = 15.1(1)sg`
- `ios = 15.1(1)sg1`
- `ios = 15.1(1)sg2`
- `ios = 15.1(1)sy`
- `ios = 15.1(1)sy1`
- `ios = 15.1(1)sy2`
- `ios = 15.1(1)sy3`
- `ios = 15.1(1)sy4`
- `ios = 15.1(1)sy5`
- `ios = 15.1(1)sy6`
- `ios = 15.1(2)s`
- `ios = 15.1(2)s1`
- `ios = 15.1(2)s2`
- `ios = 15.1(2)sg`
- `ios = 15.1(2)sg1`
- `ios = 15.1(2)sg2`
- `ios = 15.1(2)sg3`
- `ios = 15.1(2)sg4`
- `ios = 15.1(2)sg5`
- `ios = 15.1(2)sg6`
- `ios = 15.1(2)sg7`
- `ios = 15.1(2)sg8`
- `ios = 15.1(2)sy`
- `ios = 15.1(2)sy1`
- `ios = 15.1(2)sy2`
- `ios = 15.1(2)sy3`
- `ios = 15.1(2)sy4`
- `ios = 15.1(2)sy4a`
- `ios = 15.1(2)sy5`
- `ios = 15.1(2)sy6`
- `ios = 15.1(2)sy7`
- `ios = 15.1(2)sy8`
- `ios = 15.1(2)sy9`
- `ios = 15.1(2)sy10`
- `ios = 15.1(2)sy11`
- `ios = 15.1(2)sy12`
- `ios = 15.1(2)sy13`
- `ios = 15.1(2)sy14`
- `ios = 15.1(2)sy15`
- `ios = 15.1(2)sy16`
- `ios = 15.1(3)mra`
- `ios = 15.1(3)mra1`
- `ios = 15.1(3)mra2`
- `ios = 15.1(3)mra3`
- `ios = 15.1(3)mra4`
- `ios = 15.1(3)s`
- `ios = 15.1(3)s0a`
- `ios = 15.1(3)s1`
- `ios = 15.1(3)s2`
- `ios = 15.1(3)s3`
- `ios = 15.1(3)s4`
- `ios = 15.1(3)s5`
- `ios = 15.1(3)s5a`
- `ios = 15.1(3)s6`
- `ios = 15.1(3)svb1`
- `ios = 15.1(3)svb2`
- `ios = 15.1(3)svd`
- `ios = 15.1(3)svd1`
- `ios = 15.1(3)svd2`
- `ios = 15.1(3)sve`
- `ios = 15.1(3)svf`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.