CVE-2025-20164High· 8.3▾ TwilightA vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate privileges. This vulnerability is due to insufficient validation of authorizati…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate privileges.
This vulnerability is due to insufficient validation of authorizations for authenticated users. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to elevate privileges to privilege level 15.
To exploit this vulnerability, the attacker must have valid credentials for a user account with privilege level 5 or higher. Read-only DM users are assigned privilege level 5.
IOS 15.0(2)SE8IOS 15.0(2)EAIOS 15.0(2)EA1IOS 15.2(2)EIOS 15.2(2)E1IOS 15.2(3)E1IOS 15.2(2)E2IOS 15.2(2)E3IOS 15.2(2a)E2IOS 15.2(3)E2IOS 15.2(3)E3IOS 15.2(2)E4IOS 15.2(2)E5IOS 15.2(3)E4IOS 15.2(5)EIOS 15.2(2)E6IOS 15.2(5)E1IOS 15.2(2)E5aIOS 15.2(5a)E1IOS 15.2(2)E7IOS 15.2(5)E2IOS 15.2(6)EIOS 15.2(5)E2cIOS 15.2(2)E8IOS 15.2(6)E0aIOS 15.2(6)E1IOS 15.2(6)E0cIOS 15.2(2)E9IOS 15.2(7)EIOS 15.2(2)E10IOS 15.2(6)E2aIOS 15.2(7)E0bIOS 15.2(7)E0sIOS 15.2(6)E3IOS 15.2(7)E2IOS 15.2(7)E3IOS 15.2(7)E1aIOS 15.2(7)E4IOS 15.2(8)EIOS 15.2(8)E1IOS 15.2(7)E5IOS 15.2(7)E6IOS 15.2(8)E2IOS 15.2(7)E7IOS 15.2(8)E3IOS 15.2(7)E8IOS 15.2(8)E4IOS 15.2(7)E9IOS 15.2(8)E5IOS 15.2(8)E6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-20328Critical· 9.1A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected appli…
CVE-2017-6770Medium· 4.2Multiple Cisco Products OSPF LSA Manipulation Vulnerability (CVE-2017-6770)
CVE-2019-1748High· 7.4Cisco IOS and IOS XE Software Network Plug-and-Play Agent Certificate Validation Vulnerability (CVE-2019-1748)
CVE-2025-20169High· 7.7Cisco IOS, IOS XE, and IOS XR SNMP Denial of Service Vulnerabilities
CVE-2025-20175High· 7.7Cisco IOS and IOS XE SNMP Denial of Service Vulnerabilities
CVE-2025-20170High· 7.7Cisco IOS and IOS XE SNMP Denial of Service Vulnerabilities