Cisco IOS up to 15.2(8)E6 on Catalyst File signature verification

Summaryinfo

A vulnerability described as critical has been identified in Cisco IOS on Catalyst. Impacted is an unknown function of the component File Handler. Such manipulation leads to signature verification. This vulnerability is listed as CVE-2025-20181. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco IOS on Catalyst. Affected by this issue is an unknown code block of the component File Handler. The manipulation with an unknown input leads to a signature verification vulnerability. Using CWE to declare the problem leads to CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches could allow an authenticated, local attacker with privilege level 15 or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust. This vulnerability is due to missing signature verification for specific files that may be loaded during the device boot process. An attacker could exploit this vulnerability by placing a crafted file into a specific location on an affected device. A successful exploit could allow the attacker to execute arbitrary code at boot time. Because this allows the attacker to bypass a major security feature of the device, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2025-20181 since 10/10/2024. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/04/2025).

The vulnerability scanner Nessus provides a plugin with the ID 235487 (Cisco IOS Software for Catalyst 2960X 2960XR 2960CX 3560CX Series Switches Secure Boot Bypass (cisco-sa-c2960-3560-sboot-ZtqADrHq)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (235487). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS

Version

• 15.0(1)EX
• 15.0(1)EY
• 15.0(1)EY1
• 15.0(1)EY2
• 15.0(1)XO
• 15.0(1)XO1
• 15.0(2)EX
• 15.0(2)EX1
• 15.0(2)EX2
• 15.0(2)EX3
• 15.0(2)EX4
• 15.0(2)EX5
• 15.0(2)EX8
• 15.0(2)EX10
• 15.0(2)EX11
• 15.0(2)EX12
• 15.0(2)EX13
• 15.0(2)SE8
• 15.0(2)SQD
• 15.0(2)SQD1
• 15.0(2)SQD2
• 15.0(2)SQD3
• 15.0(2)SQD4
• 15.0(2)SQD5
• 15.0(2)SQD6
• 15.0(2)SQD7
• 15.0(2)SQD8
• 15.0(2)XO
• 15.0(2a)EX5
• 15.2(2)E
• 15.2(2)E1
• 15.2(2)E2
• 15.2(2)E3
• 15.2(2)E4
• 15.2(2)E5
• 15.2(2)E5a
• 15.2(2)E5b
• 15.2(2)E6
• 15.2(2)E7
• 15.2(2)E8
• 15.2(2)E9
• 15.2(2)E10
• 15.2(2a)E1
• 15.2(2a)E2
• 15.2(3)E
• 15.2(3)E1
• 15.2(3)E2
• 15.2(3)E3
• 15.2(3)E4
• 15.2(3a)E
• 15.2(4)E
• 15.2(4)E1
• 15.2(4)E2
• 15.2(4)E3
• 15.2(4)E4
• 15.2(4)E5
• 15.2(4)E6
• 15.2(4)E7
• 15.2(4)E8
• 15.2(4)E9
• 15.2(4)E10
• 15.2(4)E10a
• 15.2(4)E10d
• 15.2(4)EA7
• 15.2(4)EA8
• 15.2(4)EA9
• 15.2(4)EA9a
• 15.2(5)E
• 15.2(5)E1
• 15.2(5)E2
• 15.2(5b)E
• 15.2(6)E
• 15.2(6)E0a
• 15.2(6)E0c
• 15.2(6)E1
• 15.2(6)E2
• 15.2(6)E2a
• 15.2(6)E2b
• 15.2(6)E3
• 15.2(6)EB
• 15.2(7)E
• 15.2(7)E0a
• 15.2(7)E0b
• 15.2(7)E0s
• 15.2(7)E1
• 15.2(7)E1a
• 15.2(7)E2
• 15.2(7)E2a
• 15.2(7)E3
• 15.2(7)E3k
• 15.2(7)E4
• 15.2(7)E5
• 15.2(7)E6
• 15.2(7)E7
• 15.2(7)E8
• 15.2(7)E9
• 15.2(7)E10
• 15.2(7a)E0b
• 15.2(7b)E0b
• 15.2(8)E
• 15.2(8)E1
• 15.2(8)E2
• 15.2(8)E3
• 15.2(8)E4
• 15.2(8)E5
• 15.2(8)E6

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion