Cisco IOS XE Software Network-Based Application Recognition Denial of Service Vulnerability

🚨SEVERITY: HIGH — CVSS 8.6Security Advisory

TL;DR 📌

  • A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, causing a denial of service (DoS) condition. This vulnerability is due to improper handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets. An attacker could…
  • Highest CVSS: 8.6 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20315.

What it is

CVE-2025-20315 sits in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software, specifically in how it handles CAPWAP (Control and Provisioning of Wireless Access Points) traffic. NBAR can be configured to inspect tunnelled CAPWAP packets for classification purposes, and it is this inspection code that mishandles malformed input.

An attacker needs no credentials and no prior access to the device. They send malformed CAPWAP packets to an affected router or edge platform over the network. If NBAR is activated and CAPWAP inspection is enabled, the malformed packets cause the device to reload, producing a denial of service condition. This is a data-plane issue reachable remotely and unauthenticated (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base score 8.6).

The flaw only matters where both conditions are configured together: CAPWAP inspection for NBAR enabled (ip nbar classification tunneled-traffic capwap present in the running config) and NBAR itself activated. Devices without this combination are not affected, regardless of software version. Affected product families include 1100 Integrated Services Routers, 4000 Series Integrated Services Routers, ASR 920 and ASR 1000 Series Aggregation Services Routers, Catalyst 1101 Rugged Routers, Catalyst 8000V Edge Software, Catalyst 8200/8300/8500/8500L Edge Platforms, and Catalyst IR8300 Rugged Series Routers. Cisco has confirmed IOS Software, IOS XR Software, and NX-OS Software are not affected.

Cisco’s PSIRT states it is not aware of any public announcements or malicious use of this vulnerability, and it is not listed in the CISA Known Exploited Vulnerabilities catalogue.

What to do

  • Check exposure with two CLI commands: show running-config | include tunneled-traffic capwap (any output means CAPWAP inspection for NBAR is enabled) and show ip nbar control-plane | include NBAR state (look for “ACTIVATED”). A device is only vulnerable if both are true.
  • If both conditions are present and you cannot patch immediately, disable the feature as a mitigation: no ip nbar classification tunneled-traffic capwap in global configuration. Test for impact on any NBAR-dependent classification or QoS policies before rolling this out broadly — Cisco confirms this was proven effective in testing but has not validated it across all deployment scenarios.
  • There is no other workaround. Plan to upgrade to a fixed IOS XE release; the advisory does not list specific fixed version numbers in this summary, so use the Cisco Software Checker against your current release to get the “First Fixed” and “Combined First Fixed” versions for your platform.
  • Prioritise checking any of the listed platforms that face untrusted or internet-facing segments, since the attack path is unauthenticated and remote.

For leadership 🧭

Executive summary. Routers and edge platforms running Cisco IOS XE can be forced to reload by remote, unauthenticated attackers if a specific NBAR feature for inspecting CAPWAP traffic is enabled, causing an outage until the device restarts. Check for that configuration this week and either disable the feature or schedule a patch before it becomes a repeated availability problem.

Why it matters:

  • The attack requires no credentials or prior access — a malformed CAPWAP packet sent to the device over the network is enough to trigger a reload and denial of service.
  • Exposure depends entirely on configuration: only devices with both ‘ip nbar classification tunneled-traffic capwap’ set and NBAR activated are vulnerable, so many deployments of the same hardware are unaffected.
  • Affected families include core routing and edge platforms such as ASR 1000, ASR 920, Catalyst 8000V/8200/8300/8500 series and ISR 4000/1100 routers, all commonly sited at network edges.
  • There is no workaround beyond disabling the CAPWAP inspection feature entirely, which may affect existing NBAR-based classification or QoS policies.

Now / Next / Later:

  • Now: Run ‘show running-config | include tunneled-traffic capwap’ and ‘show ip nbar control-plane | include NBAR state’ on affected platform types to confirm whether both CAPWAP inspection for NBAR and NBAR itself are enabled.
  • Next: Where both conditions are confirmed and a patch can’t be applied immediately, disable the feature with ’no ip nbar classification tunneled-traffic capwap’ after testing for impact on QoS or classification policies, and use the Cisco Software Checker to identify the fixed IOS XE release for each platform.
  • Later: Once patched, review whether CAPWAP inspection for NBAR is genuinely needed on each device and only re-enable it where there’s a clear operational requirement, reducing the exposed configuration surface for similar future issues.

Source