Critical Privilege Escalation Vulnerability Affecting Cisco IOS XE Software
A critical security vulnerability has been identified in Cisco IOS XE Software Web UI, allowing an unauthenticated remote attacker to create an account with full administrative privileges (level 15) and achieve complete system control.
Description
Technical context and vulnerability details
Cisco IOS XE is the foundational network operating system for modern Cisco enterprise routing, switching, and wireless platforms.
These products are affected by the following vulnerabilities:
CVE-2025-20188: Critical authentication bypass and privilege escalation vulnerability (CWE-288) in the web UI server component. A remote attacker can submit crafted HTTP requests to create accounts with maximum administrative access. Classified Critical with a maximum CVSS v3.1 base score of 10.0.
Potential Risks & Impact
Potential consequences upon exploitation
- Unauthenticated creation of root/level 15 administrator accounts;
- Total compromise of Cisco routers, switches, and wireless controllers running IOS XE;
- Installation of malicious implants and persistence across reboots.
Affected systems
Products, components and targeted versions
- Cisco IOS XE Software with Web UI enabled: all releases prior to vendor maintenance updates.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Immediately apply the designated Cisco IOS XE Software maintenance release;
- Disable the HTTP/HTTPS Server feature on all internet-facing interfaces: 'no ip http server' and 'no ip http secure-server';
- Conduct forensic audits of local device user accounts and configuration changes.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.