CVE-2025-20181
First published: Wed May 07 2025(Updated: )
A vulnerability in Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches could allow an authenticated, local attacker with privilege level 15 or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust. This vulnerability is due to missing signature verification for specific files that may be loaded during the device boot process. An attacker could exploit this vulnerability by placing a crafted file into a specific location on an affected device. A successful exploit could allow the attacker to execute arbitrary code at boot time. Because this allows the attacker to bypass a major security feature of the device, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco Catalyst 2960CX Series Switches | ||
| Cisco Catalyst 2960XR Series Switches | ||
| Cisco Catalyst 2960CX Series Switches | ||
| Cisco Catalyst 3560CX Series Switches |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-20181?
CVE-2025-20181 is considered a high severity vulnerability due to its potential for allowing unauthorized code execution.
How do I fix CVE-2025-20181?
To mitigate CVE-2025-20181, apply the latest firmware updates provided by Cisco for affected switch models.
Who is affected by CVE-2025-20181?
CVE-2025-20181 affects Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches.
What kind of attacks are possible with CVE-2025-20181?
An attacker can execute persistent code during the boot process, potentially compromising the device.
Is physical access required for CVE-2025-20181 exploitation?
Yes, an unauthenticated attacker needs physical access to the device to exploit CVE-2025-20181.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/cisco
- canonical/cisco ios
- canonical/cisco catalyst 2960cx series switches
- canonical/cisco catalyst 2960xr series switches
- canonical/cisco catalyst 3560cx series switches