CVE-2025-20338
Cisco Ios Xe 16.10.1 … 3.9.2e
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2025-20338 is a medium-severity Improper Neutralization of Parameter/Argument Delimiters (CWE-141) vulnerability in Cisco Ios Xe. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31025
Vulnerability Data
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient…
more
validation of user arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by logging in to the device CLI with valid administrative (level 15) credentials and using crafted commands at the CLI prompt. A successful exploit could allow the attacker to execute arbitrary commands as root.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly requires checking and neutralizing delimiter characters in received data before forwarding to downstream components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization to prevent delimiter injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect delimiter issues but does not itself implement the neutralization.
Secure development life cycle mandates input validation and sanitization that directly prevents delimiter injection.
Application security requirements explicitly call for neutralizing special characters in inputs passed to downstream components.
Secure system architecture principles encourage safe interfaces but do not prescribe delimiter neutralization.
Secure coding standards require proper escaping or neutralization of parameter delimiters in all downstream calls.