CISCO-SA-WEBUI-MULTI-ARNHM4V6

CISCO-SA-WEBUI-MULTI-ARNHM4V6 PUBLISHED CVSS 6.5 MEDIUM

Multiple vulnerabilities in the web-based management interface of Cisco IOS XE Software could allow a remote attacker to read files from the underlying operating system, read limited parts of the configuration file, clear the syslog, or conduct a cross-site request forgery (CSRF) attack on an affected device, depending on their privilege level. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. This advisory is part of the May 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75279"].

Risk Scores

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
	16.3.7
	16.4.2
	16.3.5b
	16.2.1
	16.3.3
	16.3.1
	16.3.11
	16.3.8
	16.3.5
	16.3.10
	16.3.1a
	16.1.2
	16.3.9
	16.4.1
	16.2.2
	16.1.1
	16.1.3
	16.3.4
	16.3.2
	16.3.6

Exploit Intelligence

…and 3 more exploits

Timeline

May 7, 2025 CVE Published

References

Open in Interactive Console →