According to its self-reported version, Cisco IOS-XE Software is affected by multiple vulnerabilities.

  - Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with     level-15 privileges or an unauthenticated attacker with physical access to the device to execute     persistent code at boot time and break the chain of trust. These vulnerabilities are due path traversal     and improper image integrity validation. A successful exploit could allow the attacker to execute     persistent code on the underlying operating system. Because this allows the attacker to bypass a major     security feature of the device, Cisco has raised the Security Impact Rating (SIR) of this advisory from     Medium to High. For more information about these vulnerabilities, see the Details [#details] section of     this advisory. ERP (CVE-2025-20313)

  - A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15     privileges or an unauthenticated attacker with physical access to an affected device to execute persistent     code at boot time and break the chain of trust. This vulnerability is due to improper validation of     software packages. An attacker could exploit this vulnerability by placing a crafted file into a specific     location on an affected device. A successful exploit could allow the attacker to execute persistent code     on the underlying operating system. Because this vulnerability allows an attacker to bypass a major     security feature of a device, Cisco has raised the Security Impact Rating (SIR) of this advisory from     Medium to High. (CVE-2025-20314)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Detections

Analytics

Cisco IOS XE Software Secure Boot Bypass (cisco-sa-secboot-UqFD8AvC)

medium Nessus Plugin ID 265805

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Oct 18, 2025, 4:00 AM Metadata (Add IAVM info) Plugin Feed: 202510180400
Version 1.3 Oct 16, 2025, 4:39 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510161639
Version 1.2 Sep 26, 2025, 3:17 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202509261517
Version 1.1 Sep 25, 2025, 3:39 PM New Plugin Feed: 202509251539