How severe is CVE-2025-20363?

CVE-2025-20363 has a CVSS 3.x base score of 9.0, rated critical severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-20363 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-20363?

CVE-2025-20363 primarily affects Cisco Ios Xr. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-20363?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-20363 have an EU (EUVD) identifier?

Yes. CVE-2025-20363 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-31138.

When was CVE-2025-20363 published?

CVE-2025-20363 was published on 2025-09-25 and last updated on 2026-06-17.

CVE-2025-20363

CVE-2025-20363 is a critical-severity vulnerability in Cisco Ios Xr with a CVSS 3.x base score of 9.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-122.

Key facts

Severity: Critical (CVSS 3.x base score 9.0)
EPSS exploit prediction: 8% (94th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-31138
Weakness: CWE-122
Affected product: Cisco Ios Xr
Published: 2025-09-25
Last modified: 2026-06-17

Description

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

Frequently asked questions

What is CVE-2025-20363?: A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.
How severe is CVE-2025-20363?: CVE-2025-20363 has a CVSS 3.x base score of 9.0, rated critical severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-20363 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-20363?: CVE-2025-20363 primarily affects Cisco Ios Xr. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-20363?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-20363 have an EU (EUVD) identifier?: Yes. CVE-2025-20363 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-31138.
When was CVE-2025-20363 published?: CVE-2025-20363 was published on 2025-09-25 and last updated on 2026-06-17.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O

Affected products (18)

cpe:2.3:o:cisco:ios_xr:6.5.1:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.5.2:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.6.2:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.6.3:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.6.25:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.7.1:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.7.2:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.7.3:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.8.1:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.8.2:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.9.1:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:ios_xr:6.9.2:*:*:*:*:*:x86:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.6.0:*:*:*:*:*:*:*

More vulnerabilities in Cisco Ios Xr

CVE-2020-3284 — Critical (CVSS 9.8): A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could…
CVE-2019-1710 — Critical (CVSS 9.8): A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running…
CVE-2026-20046 — High (CVSS 8.8): A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an…
CVE-2026-20040 — High (CVSS 8.8): A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary…
CVE-2025-20138 — High (CVSS 8.8): A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary…
CVE-2024-20398 — High (CVSS 8.8): A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write…

All CVEs affecting Cisco Ios Xr →

Other CWE-122 (Heap-based Buffer Overflow) vulnerabilities

CVE-2026-46752 — Critical (CVSS 10.0): Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from…
CVE-2026-24822 — Critical (CVSS 10.0): Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules). This vulnerability is…
CVE-2025-23123 — Critical (CVSS 10.0): A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a…
CVE-2022-34819 — Critical (CVSS 10.0): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions <…
CVE-2026-44050 — Critical (CVSS 9.9): A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote…
CVE-2026-49841 — Critical (CVSS 9.8): FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to…

Browse all CWE-122 (Heap-based Buffer Overflow) vulnerabilities →