CVE-2025-20315
Published: 24 September 2025
Summary
CVE-2025-20315 is a high-severity Buffer Access with Incorrect Length Value (CWE-805) vulnerability in Cisco IOS XE (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-20315 is a vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software. The issue stems from improper handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets, which could allow an unauthenticated, remote attacker to cause an affected device to reload and trigger a denial of service (DoS) condition. Published on 2025-09-24, it has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and is linked to CWE-805.
An unauthenticated, remote attacker can exploit this vulnerability by sending malformed CAPWAP packets through an affected device. Successful exploitation causes the device to reload unexpectedly, resulting in a DoS condition that disrupts network services.
The Cisco Security Advisory provides details on mitigation and affected versions at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nbar-dos-LAvwTmeT.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31036
Vulnerability details
A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, causing a denial of service (DoS) condition. This vulnerability is due to improper…
more
handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets. An attacker could exploit this vulnerability by sending malformed CAPWAP packets through an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Malformed CAPWAP packet handling leads to device reload DoS via direct system exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific flaw in NBAR's handling of malformed CAPWAP packets by requiring timely application of vendor patches to Cisco IOS XE software.
Implements denial-of-service protections such as traffic filtering and rate limiting to block or mitigate malformed CAPWAP packets that trigger device reloads.
Enforces boundary protection to monitor and control network traffic, allowing filtering of unauthorized or suspicious CAPWAP packets before they reach the affected NBAR-enabled device.