CVE-2025-20311: High severity Cisco IOS XE Software for Catalyst 9000 Series Switches vulnerability

Published Sep 24, 2025

Updated

A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic. This vulnerability is due to improper handling of crafted Ethernet frames. An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. A successful exploit could allow the attacker to cause the egress port to which the crafted frame is forwarded to start dropping all frames, resulting in a denial of service (DoS) condition.

Affected Software

159 affected components

Cisco IOS XE Software for Catalyst 9000 Series Switches

All of the following

Any of the following

Cisco IOS XE=16.6.1

Cisco IOS XE=16.6.2

Cisco IOS XE=16.6.3

Cisco IOS XE=16.6.4

Cisco IOS XE=16.6.4a

Cisco IOS XE=16.6.5

Cisco IOS XE=16.6.6

Cisco IOS XE=16.6.7

Cisco IOS XE=16.6.8

Cisco IOS XE=16.6.9

Cisco IOS XE=16.6.10

Cisco IOS XE=16.7.1

Cisco IOS XE=16.8.1

Cisco IOS XE=16.8.1a

Cisco IOS XE=16.8.1s

Cisco IOS XE=16.9.1

Cisco IOS XE=16.9.1s

Cisco IOS XE=16.9.2

Cisco IOS XE=16.9.3

Cisco IOS XE=16.9.4

Cisco IOS XE=16.9.5

Cisco IOS XE=16.9.6

Cisco IOS XE=16.9.7

Cisco IOS XE=16.9.8

Cisco IOS XE=16.10.1

Cisco IOS XE=16.10.1e

Cisco IOS XE=16.10.1s

Cisco IOS XE=16.11.1

Cisco IOS XE=16.11.1b

Cisco IOS XE=16.11.1s

Cisco IOS XE=16.12.1

Cisco IOS XE=16.12.1c

Cisco IOS XE=16.12.1s

Cisco IOS XE=16.12.2

Cisco IOS XE=16.12.2s

Cisco IOS XE=16.12.3

Cisco IOS XE=16.12.3a

Cisco IOS XE=16.12.3s

Cisco IOS XE=16.12.4

Cisco IOS XE=16.12.4a

Cisco IOS XE=16.12.5

Cisco IOS XE=16.12.5b

Cisco IOS XE=16.12.6

Cisco IOS XE=16.12.6a

Cisco IOS XE=16.12.7

Cisco IOS XE=16.12.8

Cisco IOS XE=16.12.14

Cisco IOS XE=17.1.1

Cisco IOS XE=17.1.1s

Cisco IOS XE=17.1.1t

Cisco IOS XE=17.1.3

Cisco IOS XE=17.2.1

Cisco IOS XE=17.2.1a

Cisco IOS XE=17.3.1

Cisco IOS XE=17.3.2

Cisco IOS XE=17.3.2a

Cisco IOS XE=17.3.3

Cisco IOS XE=17.3.4

Cisco IOS XE=17.3.4b

Cisco IOS XE=17.3.5

Cisco IOS XE=17.3.6

Cisco IOS XE=17.3.7

Cisco IOS XE=17.3.8

Cisco IOS XE=17.3.8a

Cisco IOS XE=17.4.1

Cisco IOS XE=17.5.1

Cisco IOS XE=17.6.1

Cisco IOS XE=17.6.1y

Cisco IOS XE=17.6.2

Cisco IOS XE=17.6.3

Cisco IOS XE=17.6.4

Cisco IOS XE=17.6.5

Cisco IOS XE=17.6.5a

Cisco IOS XE=17.6.6

Cisco IOS XE=17.6.6a

Cisco IOS XE=17.6.7

Cisco IOS XE=17.6.8

Cisco IOS XE=17.7.1

Cisco IOS XE=17.8.1

Cisco IOS XE=17.9.1

Cisco IOS XE=17.9.2

Cisco IOS XE=17.9.3

Cisco IOS XE=17.9.4

Cisco IOS XE=17.9.4a

Cisco IOS XE=17.9.5

Cisco IOS XE=17.9.6

Cisco IOS XE=17.9.6a

Cisco IOS XE=17.10.1

Cisco IOS XE=17.10.1b

Cisco IOS XE=17.11.1

Cisco IOS XE=17.11.99sw

Cisco IOS XE=17.12.1

Cisco IOS XE=17.12.1z3

Cisco IOS XE=17.12.2

Cisco IOS XE=17.12.3

Cisco IOS XE=17.12.4

Cisco IOS XE=17.13.1

Cisco IOS XE=17.14.1

Cisco IOS XE=17.15.1

Cisco IOS XE=17.15.2

Cisco IOS XE=17.15.2a

Cisco IOS XE=17.15.2b

Cisco IOS XE=17.16.1

Any of the following

Cisco Catalyst 9200

Cisco Catalyst 9200cx

Cisco Catalyst 9200l

Cisco Catalyst 9300

Cisco Catalyst 9300-24p-a

Cisco Catalyst 9300-24p-e

Cisco Catalyst 9300-24s-a

Cisco Catalyst 9300-24s-e

Cisco Catalyst 9300-24t-a

Cisco Catalyst 9300-24t-e

Cisco Catalyst 9300-24u-a

Cisco Catalyst 9300-24u-e

Cisco Catalyst 9300-24ux-a

Cisco Catalyst 9300-24ux-e

Cisco Catalyst 9300-48p-a

Cisco Catalyst 9300-48p-e

Cisco Catalyst 9300-48s-a

Cisco Catalyst 9300-48s-e

Cisco Catalyst 9300-48t-a

Cisco Catalyst 9300-48t-e

Cisco Catalyst 9300-48u-a

Cisco Catalyst 9300-48u-e

Cisco Catalyst 9300-48un-a

Cisco Catalyst 9300-48un-e

Cisco Catalyst 9300-48uxm-a

Cisco Catalyst 9300-48uxm-e

Cisco Catalyst 9300l

Cisco Catalyst 9300l-24p-4g-a

Cisco Catalyst 9300l-24p-4g-e

Cisco Catalyst 9300l-24p-4x-a

Cisco Catalyst 9300l-24p-4x-e

Cisco Catalyst 9300l-24t-4g-a

Cisco Catalyst 9300l-24t-4g-e

Cisco Catalyst 9300l-24t-4x-a

Cisco Catalyst 9300l-24t-4x-e

Cisco Catalyst 9300l-48p-4g-a

Cisco Catalyst 9300l-48p-4g-e

Cisco Catalyst 9300l-48p-4x-a

Cisco Catalyst 9300l-48p-4x-e

Cisco Catalyst 9300l-48t-4g-a

Cisco Catalyst 9300l-48t-4g-e

Cisco Catalyst 9300l-48t-4x-a

Cisco Catalyst 9300l-48t-4x-e

Cisco Catalyst 9300l Stack

Cisco Catalyst 9300lm

Cisco Catalyst 9300x

Cisco Catalyst 9400

Cisco Catalyst 9400 Supervisor Engine-1

Cisco Catalyst 9407r

Cisco Catalyst 9410r

Cisco Catalyst 9500

Cisco Catalyst 9500h

Cisco Catalyst 9600

Cisco Catalyst 9600 Supervisor Engine-1

Cisco Catalyst 9600x

Event History

Sep 24, 2025

CVE Published

via MITRE·05:12 PM

Data Sourced

via MITRE·05:12 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-20311?

CVE-2025-20311 has a high severity level due to its potential impact on network availability.

How do I fix CVE-2025-20311?

To fix CVE-2025-20311, you should update your Cisco IOS XE Software for Catalyst 9000 Series Switches to the latest version provided by Cisco.

Who is affected by CVE-2025-20311?

CVE-2025-20311 affects Cisco IOS XE Software for the Catalyst 9000 Series Switches.

What can an attacker do with CVE-2025-20311?

An attacker exploiting CVE-2025-20311 can block an egress port, causing all outbound traffic to drop.

Is CVE-2025-20311 remotely exploitable?

CVE-2025-20311 is not remotely exploitable as it requires an adjacent attacker to exploit the vulnerability.