Cyber Resilience

CVE-2025-20199

Cisco Ios Xe 16.1.1 … 3.9.2s

Published
07 May 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v3.1 4.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0016 5th percentile
Risk Priority 31 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-20199 is a medium-severity an unspecified weakness vulnerability in Cisco Ios Xe. Its CVSS base score is 4.6 (Medium).

Operationally, ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device. This vulnerability is due to insufficient…

more

input validation when processing specific configuration commands. An attacker could exploit this vulnerability by including crafted input in specific configuration commands. A successful exploit could allow the attacker to elevate privileges to root on the underlying operating system of an affected device. The security impact rating (SIR) of this advisory has been raised to High because an attacker could gain access to the underlying operating system of the affected device and perform potentially undetected actions. Note: The attacker must have privileges to enter configuration mode on the affected device. This is usually referred to as privilege level 15.

CWE(s)

Related Threats

CVEs Like This One

CVE-2024-20437Same product: Cisco Ios Xe
CVE-2026-20270Same product: Cisco Ios Xe
CVE-2023-20072Same product: Cisco Ios Xe
CVE-2025-20200Same product: Cisco Ios Xe
CVE-2024-20480Same product: Cisco Ios Xe
CVE-2018-0151Same product: Cisco Ios Xe
CVE-2024-20316Same product: Cisco Ios Xe
CVE-2024-20464Same product: Cisco Ios Xe
CVE-2025-20221Same product: Cisco Ios Xe
CVE-2024-20313Same product: Cisco Ios Xe

Affected Assets

cisco
ios xe
16.1.1, 16.1.2, 16.1.3, 16.10.1, 16.10.1a

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References