Cyber Resilience

CVE-2025-20176

Cisco Ios 15.0\(1\)sy … 15.9\(3\)m9

Published
05 February 2025
Modified
03 July 2025
Patch / advisory
CVSS Score v3.1 7.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0075 52th percentile
Risk Priority 56 floored blend · peak EPSS

Summary

CVE-2025-20176 is a high-severity Uncaught Exception (CWE-248) vulnerability in Cisco Ios. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SC-24 (Fail in Known State) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-20176 is a vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software that could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition on an affected device. The issue stems from improper error handling when parsing SNMP requests, affecting SNMP versions 1, 2c, and 3. Published on 2025-02-05, it has a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) and is associated with CWE-248 (Uncaught Exception).

An attacker could exploit this vulnerability by sending a crafted SNMP request to the affected device. Exploitation requires authentication: for SNMP v2c or earlier, knowledge of a valid read-write or read-only SNMP community string; for SNMP v3, valid SNMP user credentials. A successful exploit would cause the device to reload unexpectedly, resulting in a DoS condition.

Cisco has published a security advisory with details on the vulnerability, affected releases, and mitigation steps, available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-dos-sdxnSUcW.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper error handling when parsing…

more

SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.  This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-20173Same product: Cisco Ios
CVE-2025-20171Same product: Cisco Ios
CVE-2025-20172Same product: Cisco Ios
CVE-2024-20312Same product: Cisco Ios
CVE-2024-20311Same product: Cisco Ios
CVE-2024-20276Same product: Cisco Ios
CVE-2017-6627Same product: Cisco Ios
CVE-2017-6663Same product: Cisco Ios
CVE-2024-20307Same product: Cisco Ios
CVE-2025-20169Same product: Cisco Ios

Affected Assets

cisco
ios
15.0\(1\)sy, 15.0\(1\)sy1, 15.0\(1\)sy10, 15.0\(1\)sy2, 15.0\(1\)sy3
cisco
ios xe
16.1.1, 16.1.2, 16.1.3, 16.10.1, 16.10.1a

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Security engineering principles include robust exception management to keep the system in a defined state.

Fail-in-known-state reduces the impact when an uncaught exception occurs by preserving a safe condition.

Error handling requirements force structured catching and response to exceptions instead of allowing them to propagate uncaught.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect uncaught exceptions before production deployment.

prevents

Secure development lifecycle includes exception-handling standards that reduce uncaught exceptions.

prevents

Application security requirements typically mandate robust error and exception handling.

prevents

Secure architecture principles call for centralized, comprehensive exception management.

prevents

Secure coding standards directly require catching and handling exceptions to prevent crashes or leaks.

References