Vulnerability-Lookup

CVE-2025-20364 (GCVE-0-2025-20364)

Vulnerability from cvelistv5 – Published: 2025-09-24 16:40 – Updated: 2025-10-15 16:05

Summary

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-15 16:05 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

cisco CNA under the mitre root

CNA scorecard C 66/100 over 443 records in the last 180 days details

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version	CPE status
Cisco	Cisco Aironet Access Point Software (IOS XE Controller)	Affected: 16.10.1e Affected: 16.10.1 Affected: 17.1.1t Affected: 17.1.1s Affected: 17.1.1 Affected: 16.11.1a Affected: 16.11.1 Affected: 16.11.1c Affected: 16.11.1b Affected: 16.12.1s Affected: 16.12.4 Affected: 16.12.1 Affected: 16.12.2s Affected: 16.12.1t Affected: 16.12.4a Affected: 16.12.5 Affected: 16.12.3 Affected: 16.12.6 Affected: 16.12.8 Affected: 16.12.7 Affected: 16.12.6a Affected: 17.3.1 Affected: 17.3.2a Affected: 17.3.3 Affected: 17.3.4 Affected: 17.3.5 Affected: 17.3.2 Affected: 17.3.4c Affected: 17.3.5a Affected: 17.3.5b Affected: 17.3.6 Affected: 17.3.7 Affected: 17.3.8 Affected: 17.3.8a Affected: 17.2.1 Affected: 17.2.1a Affected: 17.2.3 Affected: 17.2.2 Affected: 17.5.1 Affected: 17.4.1 Affected: 17.6.1 Affected: 17.6.2 Affected: 17.6.3 Affected: 17.6.4 Affected: 17.6.5 Affected: 17.6.6 Affected: 17.6.6a Affected: 17.6.5a Affected: 17.6.7 Affected: 17.6.8 Affected: 17.10.1 Affected: 17.9.1 Affected: 17.9.2 Affected: 17.9.3 Affected: 17.9.4 Affected: 17.9.5 Affected: 17.9.6 Affected: 17.7.1 Affected: 17.8.1 Affected: 17.11.1 Affected: 17.12.1 Affected: 17.12.2 Affected: 17.12.3 Affected: 17.12.4 Affected: 17.12.5 Affected: 17.13.1 Affected: 17.14.1 Affected: 17.15.1 Affected: 17.15.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-20364",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-15T16:05:06.927564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-15T16:05:13.010Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Aironet Access Point Software (IOS XE Controller)",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "16.10.1e"
            },
            {
              "status": "affected",
              "version": "16.10.1"
            },
            {
              "status": "affected",
              "version": "17.1.1t"
            },
            {
              "status": "affected",
              "version": "17.1.1s"
            },
            {
              "status": "affected",
              "version": "17.1.1"
            },
            {
              "status": "affected",
              "version": "16.11.1a"
            },
            {
              "status": "affected",
              "version": "16.11.1"
            },
            {
              "status": "affected",
              "version": "16.11.1c"
            },
            {
              "status": "affected",
              "version": "16.11.1b"
            },
            {
              "status": "affected",
              "version": "16.12.1s"
            },
            {
              "status": "affected",
              "version": "16.12.4"
            },
            {
              "status": "affected",
              "version": "16.12.1"
            },
            {
              "status": "affected",
              "version": "16.12.2s"
            },
            {
              "status": "affected",
              "version": "16.12.1t"
            },
            {
              "status": "affected",
              "version": "16.12.4a"
            },
            {
              "status": "affected",
              "version": "16.12.5"
            },
            {
              "status": "affected",
              "version": "16.12.3"
            },
            {
              "status": "affected",
              "version": "16.12.6"
            },
            {
              "status": "affected",
              "version": "16.12.8"
            },
            {
              "status": "affected",
              "version": "16.12.7"
            },
            {
              "status": "affected",
              "version": "16.12.6a"
            },
            {
              "status": "affected",
              "version": "17.3.1"
            },
            {
              "status": "affected",
              "version": "17.3.2a"
            },
            {
              "status": "affected",
              "version": "17.3.3"
            },
            {
              "status": "affected",
              "version": "17.3.4"
            },
            {
              "status": "affected",
              "version": "17.3.5"
            },
            {
              "status": "affected",
              "version": "17.3.2"
            },
            {
              "status": "affected",
              "version": "17.3.4c"
            },
            {
              "status": "affected",
              "version": "17.3.5a"
            },
            {
              "status": "affected",
              "version": "17.3.5b"
            },
            {
              "status": "affected",
              "version": "17.3.6"
            },
            {
              "status": "affected",
              "version": "17.3.7"
            },
            {
              "status": "affected",
              "version": "17.3.8"
            },
            {
              "status": "affected",
              "version": "17.3.8a"
            },
            {
              "status": "affected",
              "version": "17.2.1"
            },
            {
              "status": "affected",
              "version": "17.2.1a"
            },
            {
              "status": "affected",
              "version": "17.2.3"
            },
            {
              "status": "affected",
              "version": "17.2.2"
            },
            {
              "status": "affected",
              "version": "17.5.1"
            },
            {
              "status": "affected",
              "version": "17.4.1"
            },
            {
              "status": "affected",
              "version": "17.6.1"
            },
            {
              "status": "affected",
              "version": "17.6.2"
            },
            {
              "status": "affected",
              "version": "17.6.3"
            },
            {
              "status": "affected",
              "version": "17.6.4"
            },
            {
              "status": "affected",
              "version": "17.6.5"
            },
            {
              "status": "affected",
              "version": "17.6.6"
            },
            {
              "status": "affected",
              "version": "17.6.6a"
            },
            {
              "status": "affected",
              "version": "17.6.5a"
            },
            {
              "status": "affected",
              "version": "17.6.7"
            },
            {
              "status": "affected",
              "version": "17.6.8"
            },
            {
              "status": "affected",
              "version": "17.10.1"
            },
            {
              "status": "affected",
              "version": "17.9.1"
            },
            {
              "status": "affected",
              "version": "17.9.2"
            },
            {
              "status": "affected",
              "version": "17.9.3"
            },
            {
              "status": "affected",
              "version": "17.9.4"
            },
            {
              "status": "affected",
              "version": "17.9.5"
            },
            {
              "status": "affected",
              "version": "17.9.6"
            },
            {
              "status": "affected",
              "version": "17.7.1"
            },
            {
              "status": "affected",
              "version": "17.8.1"
            },
            {
              "status": "affected",
              "version": "17.11.1"
            },
            {
              "status": "affected",
              "version": "17.12.1"
            },
            {
              "status": "affected",
              "version": "17.12.2"
            },
            {
              "status": "affected",
              "version": "17.12.3"
            },
            {
              "status": "affected",
              "version": "17.12.4"
            },
            {
              "status": "affected",
              "version": "17.12.5"
            },
            {
              "status": "affected",
              "version": "17.13.1"
            },
            {
              "status": "affected",
              "version": "17.14.1"
            },
            {
              "status": "affected",
              "version": "17.15.1"
            },
            {
              "status": "affected",
              "version": "17.15.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information.\r\n\r This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "Origin Validation Error",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-24T17:17:11.787Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-action-frame-inj-QqCNcz8H",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H"
        }
      ],
      "source": {
        "advisory": "cisco-sa-action-frame-inj-QqCNcz8H",
        "defects": [
          "CSCwn50822"
        ],
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20364",
    "datePublished": "2025-09-24T16:40:16.242Z",
    "dateReserved": "2024-10-10T19:15:13.258Z",
    "dateUpdated": "2025-10-15T16:05:13.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-20364",
      "date": "2026-10-30",
      "epss": "0.0012",
      "percentile": "0.01793"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Cisco Aironet Access Point Software (IOS XE Controller)",
                "vendor": "Cisco",
                "versions": [
                  {
                    "status": "affected",
                    "version": "16.10.1e"
                  },
                  {
                    "status": "affected",
                    "version": "16.10.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.1.1t"
                  },
                  {
                    "status": "affected",
                    "version": "17.1.1s"
                  },
                  {
                    "status": "affected",
                    "version": "17.1.1"
                  },
                  {
                    "status": "affected",
                    "version": "16.11.1a"
                  },
                  {
                    "status": "affected",
                    "version": "16.11.1"
                  },
                  {
                    "status": "affected",
                    "version": "16.11.1c"
                  },
                  {
                    "status": "affected",
                    "version": "16.11.1b"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.1s"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.4"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.1"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.2s"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.1t"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.4a"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.5"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.3"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.6"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.8"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.7"
                  },
                  {
                    "status": "affected",
                    "version": "16.12.6a"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.2a"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.3"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.4"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.5"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.2"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.4c"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.5a"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.5b"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.6"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.7"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.8"
                  },
                  {
                    "status": "affected",
                    "version": "17.3.8a"
                  },
                  {
                    "status": "affected",
                    "version": "17.2.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.2.1a"
                  },
                  {
                    "status": "affected",
                    "version": "17.2.3"
                  },
                  {
                    "status": "affected",
                    "version": "17.2.2"
                  },
                  {
                    "status": "affected",
                    "version": "17.5.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.4.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.2"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.3"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.4"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.5"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.6"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.6a"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.5a"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.7"
                  },
                  {
                    "status": "affected",
                    "version": "17.6.8"
                  },
                  {
                    "status": "affected",
                    "version": "17.10.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.9.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.9.2"
                  },
                  {
                    "status": "affected",
                    "version": "17.9.3"
                  },
                  {
                    "status": "affected",
                    "version": "17.9.4"
                  },
                  {
                    "status": "affected",
                    "version": "17.9.5"
                  },
                  {
                    "status": "affected",
                    "version": "17.9.6"
                  },
                  {
                    "status": "affected",
                    "version": "17.7.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.8.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.11.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.12.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.12.2"
                  },
                  {
                    "status": "affected",
                    "version": "17.12.3"
                  },
                  {
                    "status": "affected",
                    "version": "17.12.4"
                  },
                  {
                    "status": "affected",
                    "version": "17.12.5"
                  },
                  {
                    "status": "affected",
                    "version": "17.13.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.14.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.15.1"
                  },
                  {
                    "status": "affected",
                    "version": "17.15.3"
                  }
                ]
              }
            ],
            "source": "psirt@cisco.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information.\r\n\r This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad en el procesamiento de tramas de acci\u00f3n de Device Analytics del software de Cisco Wireless Access Point (AP) podr\u00eda permitir a un atacante no autenticado y adyacente inyectar tramas de acci\u00f3n inal\u00e1mbricas 802.11 con informaci\u00f3n arbitraria. Esta vulnerabilidad se debe a comprobaciones de verificaci\u00f3n insuficientes de las tramas de acci\u00f3n 802.11 entrantes. Un atacante podr\u00eda explotar esta vulnerabilidad enviando tramas de acci\u00f3n 802.11 de Device Analytics con par\u00e1metros arbitrarios. Un exploit exitoso podr\u00eda permitir al atacante inyectar tramas de acci\u00f3n de Device Analytics con informaci\u00f3n arbitraria, lo que podr\u00eda modificar los datos de Device Analytics de clientes inal\u00e1mbricos v\u00e1lidos que est\u00e1n conectados al mismo controlador inal\u00e1mbrico."
          }
        ],
        "id": "CVE-2025-20364",
        "lastModified": "2026-09-26T00:10:00.127",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "psirt@cisco.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-20364",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-15T16:05:06.927564Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-24T17:15:40.703",
        "references": [
          {
            "source": "psirt@cisco.com",
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H"
          }
        ],
        "sourceIdentifier": "psirt@cisco.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              }
            ],
            "source": "psirt@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-09-25T16:45:30+00:00",
      "cve": "CVE-2025-20364",
      "id": "CVE-2025-20364",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2025-20364",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-20364.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "ADJACENT_NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 4.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "LOW",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-20364",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-15T16:05:06.927564Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-09-24T17:41:31.451Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Cisco Aironet Access Point Software (IOS XE Controller)",
              "vendor": "Cisco",
              "versions": [
                {
                  "status": "affected",
                  "version": "16.10.1e"
                },
                {
                  "status": "affected",
                  "version": "16.10.1"
                },
                {
                  "status": "affected",
                  "version": "17.1.1t"
                },
                {
                  "status": "affected",
                  "version": "17.1.1s"
                },
                {
                  "status": "affected",
                  "version": "17.1.1"
                },
                {
                  "status": "affected",
                  "version": "16.11.1a"
                },
                {
                  "status": "affected",
                  "version": "16.11.1"
                },
                {
                  "status": "affected",
                  "version": "16.11.1c"
                },
                {
                  "status": "affected",
                  "version": "16.11.1b"
                },
                {
                  "status": "affected",
                  "version": "16.12.1s"
                },
                {
                  "status": "affected",
                  "version": "16.12.4"
                },
                {
                  "status": "affected",
                  "version": "16.12.1"
                },
                {
                  "status": "affected",
                  "version": "16.12.2s"
                },
                {
                  "status": "affected",
                  "version": "16.12.1t"
                },
                {
                  "status": "affected",
                  "version": "16.12.4a"
                },
                {
                  "status": "affected",
                  "version": "16.12.5"
                },
                {
                  "status": "affected",
                  "version": "16.12.3"
                },
                {
                  "status": "affected",
                  "version": "16.12.6"
                },
                {
                  "status": "affected",
                  "version": "16.12.8"
                },
                {
                  "status": "affected",
                  "version": "16.12.7"
                },
                {
                  "status": "affected",
                  "version": "16.12.6a"
                },
                {
                  "status": "affected",
                  "version": "17.3.1"
                },
                {
                  "status": "affected",
                  "version": "17.3.2a"
                },
                {
                  "status": "affected",
                  "version": "17.3.3"
                },
                {
                  "status": "affected",
                  "version": "17.3.4"
                },
                {
                  "status": "affected",
                  "version": "17.3.5"
                },
                {
                  "status": "affected",
                  "version": "17.3.2"
                },
                {
                  "status": "affected",
                  "version": "17.3.4c"
                },
                {
                  "status": "affected",
                  "version": "17.3.5a"
                },
                {
                  "status": "affected",
                  "version": "17.3.5b"
                },
                {
                  "status": "affected",
                  "version": "17.3.6"
                },
                {
                  "status": "affected",
                  "version": "17.3.7"
                },
                {
                  "status": "affected",
                  "version": "17.3.8"
                },
                {
                  "status": "affected",
                  "version": "17.3.8a"
                },
                {
                  "status": "affected",
                  "version": "17.2.1"
                },
                {
                  "status": "affected",
                  "version": "17.2.1a"
                },
                {
                  "status": "affected",
                  "version": "17.2.3"
                },
                {
                  "status": "affected",
                  "version": "17.2.2"
                },
                {
                  "status": "affected",
                  "version": "17.5.1"
                },
                {
                  "status": "affected",
                  "version": "17.4.1"
                },
                {
                  "status": "affected",
                  "version": "17.6.1"
                },
                {
                  "status": "affected",
                  "version": "17.6.2"
                },
                {
                  "status": "affected",
                  "version": "17.6.3"
                },
                {
                  "status": "affected",
                  "version": "17.6.4"
                },
                {
                  "status": "affected",
                  "version": "17.6.5"
                },
                {
                  "status": "affected",
                  "version": "17.6.6"
                },
                {
                  "status": "affected",
                  "version": "17.6.6a"
                },
                {
                  "status": "affected",
                  "version": "17.6.5a"
                },
                {
                  "status": "affected",
                  "version": "17.6.7"
                },
                {
                  "status": "affected",
                  "version": "17.6.8"
                },
                {
                  "status": "affected",
                  "version": "17.10.1"
                },
                {
                  "status": "affected",
                  "version": "17.9.1"
                },
                {
                  "status": "affected",
                  "version": "17.9.2"
                },
                {
                  "status": "affected",
                  "version": "17.9.3"
                },
                {
                  "status": "affected",
                  "version": "17.9.4"
                },
                {
                  "status": "affected",
                  "version": "17.9.5"
                },
                {
                  "status": "affected",
                  "version": "17.9.6"
                },
                {
                  "status": "affected",
                  "version": "17.7.1"
                },
                {
                  "status": "affected",
                  "version": "17.8.1"
                },
                {
                  "status": "affected",
                  "version": "17.11.1"
                },
                {
                  "status": "affected",
                  "version": "17.12.1"
                },
                {
                  "status": "affected",
                  "version": "17.12.2"
                },
                {
                  "status": "affected",
                  "version": "17.12.3"
                },
                {
                  "status": "affected",
                  "version": "17.12.4"
                },
                {
                  "status": "affected",
                  "version": "17.12.5"
                },
                {
                  "status": "affected",
                  "version": "17.13.1"
                },
                {
                  "status": "affected",
                  "version": "17.14.1"
                },
                {
                  "status": "affected",
                  "version": "17.15.1"
                },
                {
                  "status": "affected",
                  "version": "17.15.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information.\r\n\r This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "format": "cvssV3_1"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-346",
                  "description": "Origin Validation Error",
                  "lang": "en",
                  "type": "cwe"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-09-24T17:17:11.787Z",
            "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
            "shortName": "cisco"
          },
          "references": [
            {
              "name": "cisco-sa-action-frame-inj-QqCNcz8H",
              "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H"
            }
          ],
          "source": {
            "advisory": "cisco-sa-action-frame-inj-QqCNcz8H",
            "defects": [
              "CSCwn50822"
            ],
            "discovery": "INTERNAL"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "assignerShortName": "cisco",
        "cveId": "CVE-2025-20364",
        "datePublished": "2025-09-24T16:40:16.242Z",
        "dateReserved": "2024-10-10T19:15:13.258Z",
        "dateUpdated": "2025-10-15T16:05:13.010Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-11733 (CVE-2025-20364)

Vulnerability from fstec – Published: 2025-09-26 – Updated: 2025-09-26 – View on bdu.fstec.ru Fixed

Title

Уязвимость компонента Device Analytics управления микропрограммного обеспечения маршрутизаторов Cisco Wireless Access Points, позволяющая нарушителю получить доступ на изменение данных

Summary

Уязвимость компонента Device Analytics управления микропрограммного обеспечения маршрутизаторов Cisco Wireless Access Points связана с ошибкой подтверждения источника данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить доступ на изменение данных

Severity

3.3 (Low) CVSS 2.0


                      
                        AV:A/AC:L/Au:N/C:N/I:P/A:N

4.3 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Spoofing

Incidents

Being clarified

Remediation

Software update

CWE

CWE-346 - Ошибка подтверждения источника данных

Aliases

CVE-2025-20364, CISCO-SA-ACTION-FRAME-INJ-QQCNCZ8H

References

1 reference

URL
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/c…

Impacted products

10 products from 2 vendors

Vendors

Cisco Systems, Inc.

Products

Cisco Embedded Services 6300 Series APs, Aironet 1540 Series APs, Aironet 1560 Series APs, Aironet 1800 Series APs, Aironet 2800 Series APs, Aironet 3800 Series APs, Aironet 4800 APs, Catalyst 9100 APs, Catalyst IW6300 Heavy Duty Series APs, Integrated AP on 1100 Integrated Services Routers

Versions

- (Cisco Embedded Services 6300 Series APs), - (Aironet 1540 Series APs), - (Aironet 1560 Series APs), - (Aironet 1800 Series APs), - (Aironet 2800 Series APs), - (Aironet 3800 Series APs), - (Aironet 4800 APs), - (Catalyst 9100 APs), - (Catalyst IW6300 Heavy Duty Series APs), - (Integrated AP on 1100 Integrated Services Routers)

Product types

Network software, Application software, Network appliance software

Mitigations

Использование рекомендаций производителя: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H

JSON

To clipboard

{
  "CVSS 2.0": "AV:A/AC:L/Au:N/C:N/I:P/A:N",
  "CVSS 3.0": "AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Cisco Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (Cisco Embedded Services 6300 Series APs), - (Aironet 1540 Series APs), - (Aironet 1560 Series APs), - (Aironet 1800 Series APs), - (Aironet 2800 Series APs), - (Aironet 3800 Series APs), - (Aironet 4800 APs), - (Catalyst 9100 APs), - (Catalyst IW6300 Heavy Duty Series APs), - (Integrated AP on 1100 Integrated Services Routers)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "24.09.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "26.09.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "26.09.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-11733",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-20364, CISCO-SA-action-frame-inj-QqCNcz8H",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Cisco Embedded Services 6300 Series APs, Aironet 1540 Series APs, Aironet 1560 Series APs, Aironet 1800 Series APs, Aironet 2800 Series APs, Aironet 3800 Series APs, Aironet 4800 APs, Catalyst 9100 APs, Catalyst IW6300 Heavy Duty Series APs, Integrated AP on 1100 Integrated Services Routers",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Device Analytics \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 Cisco Wireless Access Points, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-346)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Device Analytics \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 Cisco Wireless Access Points \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-346",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 3,3)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,3)"
}

CISCO-SA-ACTION-FRAME-INJ-QQCNCZ8H

Vulnerability from csaf_cisco - Published: 2025-09-24 16:00 - Updated: 2025-09-24 16:00

Summary

Cisco Wireless Access Point Software Device Analytics Action Frame Injection Vulnerability

Scope

1 vulnerability in this advisory, including CVE-2025-20364.

CVE-2025-20364

4.3 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Known affected: 1 product

https://software.cisco.com

Open the full advisory

FKIE_CVE-2025-20364

Vulnerability from fkie_nvd - Published: 2025-09-24 17:15 - Updated: 2026-09-26 00:10

Severity

4.3 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Cisco Aironet Access Point Software (IOS XE Controller)",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "16.10.1e"
            },
            {
              "status": "affected",
              "version": "16.10.1"
            },
            {
              "status": "affected",
              "version": "17.1.1t"
            },
            {
              "status": "affected",
              "version": "17.1.1s"
            },
            {
              "status": "affected",
              "version": "17.1.1"
            },
            {
              "status": "affected",
              "version": "16.11.1a"
            },
            {
              "status": "affected",
              "version": "16.11.1"
            },
            {
              "status": "affected",
              "version": "16.11.1c"
            },
            {
              "status": "affected",
              "version": "16.11.1b"
            },
            {
              "status": "affected",
              "version": "16.12.1s"
            },
            {
              "status": "affected",
              "version": "16.12.4"
            },
            {
              "status": "affected",
              "version": "16.12.1"
            },
            {
              "status": "affected",
              "version": "16.12.2s"
            },
            {
              "status": "affected",
              "version": "16.12.1t"
            },
            {
              "status": "affected",
              "version": "16.12.4a"
            },
            {
              "status": "affected",
              "version": "16.12.5"
            },
            {
              "status": "affected",
              "version": "16.12.3"
            },
            {
              "status": "affected",
              "version": "16.12.6"
            },
            {
              "status": "affected",
              "version": "16.12.8"
            },
            {
              "status": "affected",
              "version": "16.12.7"
            },
            {
              "status": "affected",
              "version": "16.12.6a"
            },
            {
              "status": "affected",
              "version": "17.3.1"
            },
            {
              "status": "affected",
              "version": "17.3.2a"
            },
            {
              "status": "affected",
              "version": "17.3.3"
            },
            {
              "status": "affected",
              "version": "17.3.4"
            },
            {
              "status": "affected",
              "version": "17.3.5"
            },
            {
              "status": "affected",
              "version": "17.3.2"
            },
            {
              "status": "affected",
              "version": "17.3.4c"
            },
            {
              "status": "affected",
              "version": "17.3.5a"
            },
            {
              "status": "affected",
              "version": "17.3.5b"
            },
            {
              "status": "affected",
              "version": "17.3.6"
            },
            {
              "status": "affected",
              "version": "17.3.7"
            },
            {
              "status": "affected",
              "version": "17.3.8"
            },
            {
              "status": "affected",
              "version": "17.3.8a"
            },
            {
              "status": "affected",
              "version": "17.2.1"
            },
            {
              "status": "affected",
              "version": "17.2.1a"
            },
            {
              "status": "affected",
              "version": "17.2.3"
            },
            {
              "status": "affected",
              "version": "17.2.2"
            },
            {
              "status": "affected",
              "version": "17.5.1"
            },
            {
              "status": "affected",
              "version": "17.4.1"
            },
            {
              "status": "affected",
              "version": "17.6.1"
            },
            {
              "status": "affected",
              "version": "17.6.2"
            },
            {
              "status": "affected",
              "version": "17.6.3"
            },
            {
              "status": "affected",
              "version": "17.6.4"
            },
            {
              "status": "affected",
              "version": "17.6.5"
            },
            {
              "status": "affected",
              "version": "17.6.6"
            },
            {
              "status": "affected",
              "version": "17.6.6a"
            },
            {
              "status": "affected",
              "version": "17.6.5a"
            },
            {
              "status": "affected",
              "version": "17.6.7"
            },
            {
              "status": "affected",
              "version": "17.6.8"
            },
            {
              "status": "affected",
              "version": "17.10.1"
            },
            {
              "status": "affected",
              "version": "17.9.1"
            },
            {
              "status": "affected",
              "version": "17.9.2"
            },
            {
              "status": "affected",
              "version": "17.9.3"
            },
            {
              "status": "affected",
              "version": "17.9.4"
            },
            {
              "status": "affected",
              "version": "17.9.5"
            },
            {
              "status": "affected",
              "version": "17.9.6"
            },
            {
              "status": "affected",
              "version": "17.7.1"
            },
            {
              "status": "affected",
              "version": "17.8.1"
            },
            {
              "status": "affected",
              "version": "17.11.1"
            },
            {
              "status": "affected",
              "version": "17.12.1"
            },
            {
              "status": "affected",
              "version": "17.12.2"
            },
            {
              "status": "affected",
              "version": "17.12.3"
            },
            {
              "status": "affected",
              "version": "17.12.4"
            },
            {
              "status": "affected",
              "version": "17.12.5"
            },
            {
              "status": "affected",
              "version": "17.13.1"
            },
            {
              "status": "affected",
              "version": "17.14.1"
            },
            {
              "status": "affected",
              "version": "17.15.1"
            },
            {
              "status": "affected",
              "version": "17.15.3"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information.\r\n\r This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el procesamiento de tramas de acci\u00f3n de Device Analytics del software de Cisco Wireless Access Point (AP) podr\u00eda permitir a un atacante no autenticado y adyacente inyectar tramas de acci\u00f3n inal\u00e1mbricas 802.11 con informaci\u00f3n arbitraria. Esta vulnerabilidad se debe a comprobaciones de verificaci\u00f3n insuficientes de las tramas de acci\u00f3n 802.11 entrantes. Un atacante podr\u00eda explotar esta vulnerabilidad enviando tramas de acci\u00f3n 802.11 de Device Analytics con par\u00e1metros arbitrarios. Un exploit exitoso podr\u00eda permitir al atacante inyectar tramas de acci\u00f3n de Device Analytics con informaci\u00f3n arbitraria, lo que podr\u00eda modificar los datos de Device Analytics de clientes inal\u00e1mbricos v\u00e1lidos que est\u00e1n conectados al mismo controlador inal\u00e1mbrico."
    }
  ],
  "id": "CVE-2025-20364",
  "lastModified": "2026-09-26T00:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-20364",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-15T16:05:06.927564Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-24T17:15:40.703",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FGG9-9Q62-GFXM

Vulnerability from github – Published: 2025-09-24 18:30 – Updated: 2025-09-24 18:30

Details

This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-20364"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-24T17:15:40Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information.\n\n This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller.",
  "id": "GHSA-fgg9-9q62-gfxm",
  "modified": "2025-09-24T18:30:31Z",
  "published": "2025-09-24T18:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20364"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2025-2122

Vulnerability from csaf_certbund - Published: 2025-09-24 22:00 - Updated: 2025-09-24 22:00

Summary

Cisco Aironet Access Point: Schwachstelle ermöglicht Darstellen falscher Informationen

Severity

Niedrig

Scope

1 vulnerability in this advisory, including CVE-2025-20364.

CVE-2025-20364

Known affected: 10 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-20364 (GCVE-0-2025-20364)

BDU:2025-11733 (CVE-2025-20364)

CISCO-SA-ACTION-FRAME-INJ-QQCNCZ8H

FKIE_CVE-2025-20364

GHSA-FGG9-9Q62-GFXM

WID-SEC-W-2025-2122

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour