CVE-2025-20315

High

Published: 24 September 2025

Published

24 September 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS Score 0.0014 33.6th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20315 is a high-severity Buffer Access with Incorrect Length Value (CWE-805) vulnerability in Cisco IOS XE (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 33.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

preventrecover

Directly remediates the specific flaw in NBAR's handling of malformed CAPWAP packets by requiring timely application of vendor patches to Cisco IOS XE software.

SC-5 Denial-of-service Protection good match

preventdetect

Implements denial-of-service protections such as traffic filtering and rate limiting to block or mitigate malformed CAPWAP packets that trigger device reloads.

SC-7 Boundary Protection partial match

prevent

Enforces boundary protection to monitor and control network traffic, allowing filtering of unauthorized or suspicious CAPWAP packets before they reach the affected NBAR-enabled device.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Malformed CAPWAP packet handling leads to device reload DoS via direct system exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, causing a denial of service (DoS) condition. This vulnerability is due to improper…

handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets. An attacker could exploit this vulnerability by sending malformed CAPWAP packets through an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.

Deeper analysisAI

CVE-2025-20315 is a vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software. The issue stems from improper handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets, which could allow an unauthenticated, remote attacker to cause an affected device to reload and trigger a denial of service (DoS) condition. Published on 2025-09-24, it has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and is linked to CWE-805.

An unauthenticated, remote attacker can exploit this vulnerability by sending malformed CAPWAP packets through an affected device. Successful exploitation causes the device to reload unexpectedly, resulting in a DoS condition that disrupts network services.

The Cisco Security Advisory provides details on mitigation and affected versions at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nbar-dos-LAvwTmeT.