5.3
CVE-2025-20293
- EPSS 0.02%
- Veröffentlicht 24.09.2025 18:15:34
- Zuletzt bearbeitet 26.09.2025 14:32:53
- Quelle psirt@cisco.com
- Teams Watchlist Login
- Unerledigt Login
A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthenticated, remote attacker to access the public-key infrastructure (PKI) server that is running on an affected device. This vulnerability is due to incomplete cleanup upon completion of the Day One setup process. An attacker could exploit this vulnerability by sending Simple Certificate Enrollment Protocol (SCEP) requests to an affected device. A successful exploit could allow the attacker to request a certificate from the virtual wireless controller and then use the acquired certificate to join an attacker-controlled device to the virtual wireless controller.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt
Cisco IOS XE Software
Version
16.10.1
Status
affected
Version
16.10.1s
Status
affected
Version
16.10.1e
Status
affected
Version
16.11.1
Status
affected
Version
16.11.1a
Status
affected
Version
16.11.1b
Status
affected
Version
16.12.1
Status
affected
Version
16.12.1s
Status
affected
Version
16.12.3
Status
affected
Version
16.12.8
Status
affected
Version
16.12.2s
Status
affected
Version
16.12.1t
Status
affected
Version
16.12.4
Status
affected
Version
16.12.3s
Status
affected
Version
16.12.4a
Status
affected
Version
16.12.5
Status
affected
Version
16.12.6
Status
affected
Version
16.12.6a
Status
affected
Version
16.12.7
Status
affected
Version
17.1.1
Status
affected
Version
17.1.1s
Status
affected
Version
17.1.1t
Status
affected
Version
17.1.3
Status
affected
Version
17.2.1
Status
affected
Version
17.2.1a
Status
affected
Version
17.3.1
Status
affected
Version
17.3.2
Status
affected
Version
17.3.3
Status
affected
Version
17.3.2a
Status
affected
Version
17.3.4
Status
affected
Version
17.3.5
Status
affected
Version
17.3.6
Status
affected
Version
17.3.4c
Status
affected
Version
17.3.5a
Status
affected
Version
17.3.5b
Status
affected
Version
17.3.7
Status
affected
Version
17.3.8
Status
affected
Version
17.3.8a
Status
affected
Version
17.4.1
Status
affected
Version
17.5.1
Status
affected
Version
17.6.1
Status
affected
Version
17.6.2
Status
affected
Version
17.6.3
Status
affected
Version
17.6.4
Status
affected
Version
17.6.5
Status
affected
Version
17.6.6
Status
affected
Version
17.6.6a
Status
affected
Version
17.6.5a
Status
affected
Version
17.6.7
Status
affected
Version
17.6.8
Status
affected
Version
17.7.1
Status
affected
Version
17.10.1
Status
affected
Version
17.8.1
Status
affected
Version
17.9.1
Status
affected
Version
17.9.2
Status
affected
Version
17.9.3
Status
affected
Version
17.9.4
Status
affected
Version
17.9.4a
Status
affected
Version
17.11.1
Status
affected
Version
17.12.1
Status
affected
Version
17.12.2
Status
affected
Version
17.13.1
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.02% | 0.044 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| psirt@cisco.com | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
CWE-459 Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.