Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2025-20181: Cisco Switches: Malicious Code Can Run at Boot Time
CVE-2025-20181 · published 1 year ago
Summary
Certain Cisco switches have a flaw that allows attackers to load malicious code on the device when it starts up, potentially allowing them to control the device. This is a major security concern because it allows an attacker to bypass the device's built-in security features. To protect your device, update to the latest software version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | ios |
15.0\(1\)ex 15.0\(1\)ey 15.0\(1\)ey1 15.0\(1\)ey2 15.0\(1\)xo 15.0\(1\)xo1 15.0\(2\)ex 15.0\(2\)ex1 15.0\(2\)ex2 15.0\(2\)ex3 15.0\(2\)ex4 15.0\(2\)ex5 94 more version ranges
cpe:2.3:o:cisco:ios:15.0\(1\)ex:*:*:*:*:*:*:* |
Original advisory text
A vulnerability in Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches could allow an authenticated, local attacker with privilege level 15 or an unauthenticated...
A vulnerability in Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches could allow an authenticated, local attacker with privilege level 15 or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust.
This vulnerability is due to missing signature verification for specific files that may be loaded during the device boot process. An attacker could exploit this vulnerability by placing a crafted file into a specific location on an affected device. A successful exploit could allow the attacker to execute arbitrary code at boot time.
Because this allows the attacker to bypass a major security feature of the device, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
This vulnerability is due to missing signature verification for specific files that may be loaded during the device boot process. An attacker could exploit this vulnerability by placing a crafted file into a specific location on an affected device. A successful exploit could allow the attacker to execute arbitrary code at boot time.
Because this allows the attacker to bypass a major security feature of the device, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published7 May 2025
Updated29 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-20181 · NVD
Track software like this
Free during beta