Skip to content
Fencer Intel
medium 5.3

CVE-2025-20196 json

A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic…

published last yr. modified 4mo ago also EUVD-2025-13896

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Cisco IOx application hosting environment to stop responding, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to cause the Cisco IOx application hosting environment to stop responding. The IOx process will need to be manually restarted to recover services.

Patch / fix

  • cisco cgr1000_firmware 15.9\(3\)m12
  • cisco ic3000_industrial_compute_gateway_firmware 1.5.2
  • cisco 807_industrial_integrated_services_router_firmware 15.9\(3\)m11
  • cisco 809_industrial_integrated_services_router_firmware 15.9\(3\)m11
  • cisco 829_industrial_integrated_services_router_firmware 15.9\(3\)m11
  • cisco ios_xe 17.15.2

Is CVE-2025-20196 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
last yr.

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Cisco IOS
  • Cisco Cisco IOS XE Software

Classification

Weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.