Cisco IOS and IOS XE Software CLI Denial of Service Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.5Security Advisory

TL;DR 📌

  • A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a buffer overflow. An attacker with a low-privileged account could exploit this vulnerability by…
  • Highest CVSS: 6.5 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20149.

What it is

CVE-2025-20149 is a buffer overflow in the CLI of Cisco IOS Software and Cisco IOS XE Software. It only affects devices where the shell processing full command has been configured — this is disabled by default, so most devices are not exposed unless an administrator has explicitly enabled it.

Exploitation requires an authenticated, local attacker with a low-privileged account. They trigger the flaw by entering crafted commands at the CLI prompt. There is no network or remote access path described here — the attacker needs a shell session on the device itself.

A successful exploit causes the affected device to reload, producing a denial of service condition. There’s no indication of code execution or privilege escalation beyond the crash-and-reload effect.

Cisco has confirmed that IOS XR Software and NX-OS Software are not affected. Cisco PSIRT states that proof-of-concept exploit code is available for this vulnerability, but is not aware of any malicious use.

What to do

  • Check exposure first: run show run | include shell on IOS and IOS XE devices. No output means the device is not affected — no further action needed for this CVE.
  • If shell processing full appears in the output, the device is vulnerable. Cisco has released fixed software; use the Cisco Software Checker against this advisory (cisco-sa-ios-cli-EB7cZ6yO) to identify the first fixed release for your specific train.
  • There is no vendor-supported workaround as such, but removing the offending configuration mitigates the issue: run no shell processing full in global configuration mode. Test this in your environment first, as Cisco notes it may affect functionality depending on deployment.
  • Treat the configuration removal as a stopgap only — plan to upgrade to the fixed release identified via the Software Checker, since Cisco recommends this as the full remediation.
  • Given that proof-of-concept code exists, prioritise checking for and removing this configuration on devices with multiple low-privileged CLI users, even though the access requirement (authenticated, local) limits the immediate risk.

For leadership 🧭

Executive summary. Devices running Cisco IOS or IOS XE that have the ‘shell processing full’ command enabled can be crashed and rebooted by any user with a low-privileged CLI login, causing an outage rather than data loss. Check exposure now with a single show command; if the setting is present, plan to remove it or upgrade before the next change window since proof-of-concept code already exists.

Why it matters:

  • Any authenticated, low-privileged CLI user can trigger a buffer overflow that forces the device to reload, disrupting whatever traffic or services depend on it.
  • The exposure is limited to devices where an administrator has explicitly turned on ‘shell processing full’ — a non-default setting, so most fleets are unaffected without any action.
  • Proof-of-concept exploit code is already available, which raises the priority of checking configuration on devices with multiple low-privileged CLI accounts.
  • IOS XR and NX-OS are confirmed unaffected, so remediation effort can be focused solely on classic IOS and IOS XE estates.

Now / Next / Later:

  • Now: Run ‘show run | include shell’ on all Cisco IOS and IOS XE devices; if it returns nothing, no action is needed for this issue.
  • Next: On any device where ‘shell processing full’ is present, remove it with ’no shell processing full’ after testing in your environment, and use the Cisco Software Checker against this advisory to identify the fixed release for each affected train.
  • Later: Schedule upgrades to the fixed IOS/IOS XE releases identified via the Software Checker so the configuration removal is treated as a stopgap rather than the permanent fix, and review why ‘shell processing full’ was enabled on those devices in the first place.

Source