Cisco IOS XE Software HTTP API Command Injection Vulnerability

🚨SEVERITY: HIGH — CVSS 8.8Security Advisory

TL;DR 📌

  • A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by authenticating to an affected system and…
  • Highest CVSS: 8.8 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20334.

What it is

CVE-2025-20334 is a command injection vulnerability in the HTTP API subsystem of Cisco IOS XE Software. Insufficient input validation on API calls allows arbitrary commands to be executed on the underlying operating system with root privileges.

The vulnerability only applies to devices with the HTTP Server feature enabled — either ip http server or ip http secure-server in the running configuration. There are two exploitation paths. An attacker who already holds administrative credentials can authenticate to the device and send a crafted API call directly. Alternatively, an unauthenticated attacker can craft a malicious link and get a currently logged-in administrator to click it, triggering the injection on their behalf.

Either route leads to root-level command execution on the device’s operating system, which is a full compromise of the box rather than a partial privilege escalation.

Cisco IOS Software, IOS XR Software and NX-OS Software are confirmed not affected. This advisory covers IOS XE Software specifically, and forms part of Cisco’s September 2025 semiannual IOS/IOS XE bundled publication.

What to do

  • Check whether the HTTP Server feature is enabled: run show running-config | include ip http server|secure|active. If neither ip http server nor ip http secure-server appears, the device is not exposed to this issue.
  • If ip http server is present alongside ip http active-session-modules none, the vulnerability is not exploitable over HTTP. Similarly, ip http secure-server with ip http secure-active-session-modules none blocks exploitation over HTTPS. Confirm these session-module settings if you cannot disable the HTTP server outright.
  • There are no workarounds beyond the session-module configuration check above — Cisco states plainly that upgrading is the only full remediation.
  • Use the Cisco Software Checker against your specific IOS XE release to identify the “First Fixed” version for this advisory (or “Combined First Fixed” if cross-referencing other advisories in the same September 2025 bundle), then schedule the upgrade.
  • Given the admin-click vector, remind administrators with device access not to click unsolicited links while logged into IOS XE management interfaces, as an additional interim precaution alongside patching.

For leadership 🧭

Executive summary. Any IOS XE device with the HTTP server enabled can be fully taken over at the operating system level, either by an attacker who already has admin credentials or by tricking a logged-in administrator into clicking a link. Because there is no workaround beyond a specific session-module setting, patching should be scheduled as a priority change.

Why it matters:

  • Successful exploitation gives root privileges on the underlying OS of the router or switch, not just elevated CLI access — this is a full device compromise.
  • The link-click path means an unauthenticated attacker can reach root without ever holding valid credentials, provided an administrator is logged in and can be lured to click.
  • Exposure is tied directly to a configuration check anyone can run today: the presence of ip http server or ip http secure-server in the running config.
  • Cisco has no workaround other than disabling active session modules for HTTP/HTTPS, so devices left in default configuration remain exposed until upgraded.

Now / Next / Later:

  • Now: On every IOS XE device, run ‘show running-config | include ip http server|secure|active’ to see if the HTTP server is enabled and whether active session modules are set to none.
  • Next: For devices where the HTTP server is enabled and session modules are not disabled, use the Cisco Software Checker against the running release to find the First Fixed version and schedule the upgrade in the next change window.
  • Later: Standardise on disabling the HTTP Server feature (or setting ip http active-session-modules none / ip http secure-active-session-modules none) on IOS XE devices that don’t require it, and fold IOS XE HTTP API exposure into routine configuration audits.

Source