NCSC-2025-0146
Vulnerability from csaf_ncscnl - Published: 2025-05-08 08:43 - Updated: 2025-05-08 08:43Summary
Kwetsbaarheden verholpen in Cisco IOS XE Software
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Cisco heeft kwetsbaarheden verholpen in Cisco IOS XE Software.
Interpretaties: De kwetsbaarheden in Cisco IOS XE Software omvatten verschillende problemen, waaronder onvoldoende invoervalidatie en onjuist geheugenbeheer. Deze kwetsbaarheden kunnen worden misbruikt door ongeauthenticeerde aanvallers om Denial-of-Service (DoS) situaties te veroorzaken, ongeautoriseerde toegang te verkrijgen, en zelfs om configuraties te manipuleren. Kwetsbare systemen kunnen onverwacht opnieuw opstarten of kunnen worden blootgesteld aan ongeautoriseerde commando-injectie-aanvallen, wat de integriteit en beschikbaarheid van netwerken in gevaar kan brengen.
Oplossingen: Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-762: Mismatched Memory Management Routines
CWE-805: Buffer Access with Incorrect Length Value
CWE-347: Improper Verification of Cryptographic Signature
CWE-232: Improper Handling of Undefined Values
CWE-798: Use of Hard-coded Credentials
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-284: Improper Access Control
CWE-400: Uncontrolled Resource Consumption
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-787: Out-of-bounds Write
CWE-789: Memory Allocation with Excessive Size Value
CWE-20: Improper Input Validation
4.7 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:cisco/16.1.3
Cisco / Cisco IOS XE Software
|
vers:cisco/16.1.3 | ||
|
vers:cisco/16.10.3
Cisco / Cisco IOS XE Software
|
vers:cisco/16.10.3 | ||
|
vers:cisco/16.11.2
Cisco / Cisco IOS XE Software
|
vers:cisco/16.11.2 | ||
|
vers:cisco/16.12.9
Cisco / Cisco IOS XE Software
|
vers:cisco/16.12.9 | ||
|
vers:cisco/3.16.10bs
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.10bs | ||
|
vers:cisco/3.16.10s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.10s | ||
|
vers:cisco/16.2.2
Cisco / Cisco IOS XE Software
|
vers:cisco/16.2.2 | ||
|
vers:cisco/16.3.11
Cisco / Cisco IOS XE Software
|
vers:cisco/16.3.11 | ||
|
vers:cisco/16.4.3
Cisco / Cisco IOS XE Software
|
vers:cisco/16.4.3 | ||
|
vers:cisco/16.5.3
Cisco / Cisco IOS XE Software
|
vers:cisco/16.5.3 | ||
|
vers:cisco/16.6.10
Cisco / Cisco IOS XE Software
|
vers:cisco/16.6.10 | ||
|
vers:cisco/3.16.7bs
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.7bs | ||
|
vers:cisco/3.16.7s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.7s | ||
|
vers:cisco/16.8.3
Cisco / Cisco IOS XE Software
|
vers:cisco/16.8.3 | ||
|
vers:cisco/3.16.9s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.9s | ||
|
vers:cisco/3.10.9s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.10.9s | ||
|
vers:cisco/3.11.9e
Cisco / Cisco IOS XE Software
|
vers:cisco/3.11.9e | ||
|
vers:cisco/3.12.4s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.12.4s | ||
|
vers:cisco/3.13.9s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.13.9s | ||
|
vers:cisco/3.14.4s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.14.4s | ||
|
vers:cisco/3.15.4s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.15.4s | ||
|
vers:cisco/3.16.2as
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.2as | ||
|
vers:cisco/3.16.2bs
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.2bs | ||
|
vers:cisco/3.16.2s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.2s | ||
|
vers:cisco/3.16.3as
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.3as | ||
|
vers:cisco/3.16.3s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.3s | ||
|
vers:cisco/3.16.4s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.4s | ||
|
vers:cisco/3.16.4gs
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.4gs | ||
|
vers:cisco/3.16.4es
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.4es | ||
|
vers:cisco/3.16.4ds
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.4ds | ||
|
vers:cisco/3.16.4cs
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.4cs | ||
|
vers:cisco/3.16.4bs
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.4bs | ||
|
vers:cisco/3.16.4as
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.4as | ||
|
vers:cisco/3.16.5as
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.5as | ||
|
vers:cisco/3.16.5bs
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.5bs | ||
|
vers:cisco/3.16.5s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.5s | ||
|
vers:cisco/3.16.6bs
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.6bs | ||
|
vers:cisco/3.16.6s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.6s | ||
|
vers:cisco/3.16.7as
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.7as | ||
|
vers:cisco/3.16.8s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.8s | ||
|
vers:cisco/3.16.1as
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.1as | ||
|
vers:cisco/3.16.1s
Cisco / Cisco IOS XE Software
|
vers:cisco/3.16.1s |
7.4 (High)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
8.6 (High)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
8.6 (High)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
6.8 (Medium)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
8.6 (High)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
8.8 (High)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
10.0 (Critical)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
7.4 (High)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
6.5 (Medium)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
7.7 (High)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
5.4 (Medium)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
7.4 (High)
Affected products
Known affected
42 products, the same list as for
CVE-2025-20137
References
23 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Cisco heeft kwetsbaarheden verholpen in Cisco IOS XE Software.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden in Cisco IOS XE Software omvatten verschillende problemen, waaronder onvoldoende invoervalidatie en onjuist geheugenbeheer. Deze kwetsbaarheden kunnen worden misbruikt door ongeauthenticeerde aanvallers om Denial-of-Service (DoS) situaties te veroorzaken, ongeautoriseerde toegang te verkrijgen, en zelfs om configuraties te manipuleren. Kwetsbare systemen kunnen onverwacht opnieuw opstarten of kunnen worden blootgesteld aan ongeautoriseerde commando-injectie-aanvallen, wat de integriteit en beschikbaarheid van netwerken in gevaar kan brengen.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Mismatched Memory Management Routines",
"title": "CWE-762"
},
{
"category": "general",
"text": "Buffer Access with Incorrect Length Value",
"title": "CWE-805"
},
{
"category": "general",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
},
{
"category": "general",
"text": "Improper Handling of Undefined Values",
"title": "CWE-232"
},
{
"category": "general",
"text": "Use of Hard-coded Credentials",
"title": "CWE-798"
},
{
"category": "general",
"text": "Cross-Site Request Forgery (CSRF)",
"title": "CWE-352"
},
{
"category": "general",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
},
{
"category": "general",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-cdp-dos-fpeks9K"
},
{
"category": "external",
"summary": "Reference - cisco; cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-multi-ARNHM4v6"
},
{
"category": "external",
"summary": "Reference - cisco; cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ikev1-dos-XHk3HzFC"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-user-del-hQxMpUDj"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ"
},
{
"category": "external",
"summary": "Reference - cisco; cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC"
},
{
"category": "external",
"summary": "Reference - cisco; cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-gVn3OKNC"
},
{
"category": "external",
"summary": "Reference - cisco; cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-dhcpsn-dos-xBn8Mtks"
},
{
"category": "external",
"summary": "Reference - cisco; cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-twamp-kV4FHugn"
},
{
"category": "external",
"summary": "Reference - cisco; cveprojectv5; nvd",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-wncd-p6Gvt6HL"
}
],
"title": "Kwetsbaarheden verholpen in Cisco IOS XE Software",
"tracking": {
"current_release_date": "2025-05-08T08:43:57.415709Z",
"generator": {
"date": "2025-02-25T15:15:00Z",
"engine": {
"name": "V.A.",
"version": "1.0"
}
},
"id": "NCSC-2025-0146",
"initial_release_date": "2025-05-08T08:43:57.415709Z",
"revision_history": [
{
"date": "2025-05-08T08:43:57.415709Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:cisco/16.1.3",
"product": {
"name": "vers:cisco/16.1.3",
"product_id": "CSAFPID-2714930"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.10.3",
"product": {
"name": "vers:cisco/16.10.3",
"product_id": "CSAFPID-2715313"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.11.2",
"product": {
"name": "vers:cisco/16.11.2",
"product_id": "CSAFPID-2715043"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.12.9",
"product": {
"name": "vers:cisco/16.12.9",
"product_id": "CSAFPID-2715520"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.10bs",
"product": {
"name": "vers:cisco/3.16.10bs",
"product_id": "CSAFPID-2715459"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.10s",
"product": {
"name": "vers:cisco/3.16.10s",
"product_id": "CSAFPID-2715039"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.2.2",
"product": {
"name": "vers:cisco/16.2.2",
"product_id": "CSAFPID-2714932"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.3.11",
"product": {
"name": "vers:cisco/16.3.11",
"product_id": "CSAFPID-2715445"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.4.3",
"product": {
"name": "vers:cisco/16.4.3",
"product_id": "CSAFPID-2715031"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.5.3",
"product": {
"name": "vers:cisco/16.5.3",
"product_id": "CSAFPID-2715164"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.6.10",
"product": {
"name": "vers:cisco/16.6.10",
"product_id": "CSAFPID-2715478"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.7bs",
"product": {
"name": "vers:cisco/3.16.7bs",
"product_id": "CSAFPID-2715170"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.7s",
"product": {
"name": "vers:cisco/3.16.7s",
"product_id": "CSAFPID-2715017"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/16.8.3",
"product": {
"name": "vers:cisco/16.8.3",
"product_id": "CSAFPID-2714865"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.9s",
"product": {
"name": "vers:cisco/3.16.9s",
"product_id": "CSAFPID-2714842"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.10.9s",
"product": {
"name": "vers:cisco/3.10.9s",
"product_id": "CSAFPID-2714989"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.11.9e",
"product": {
"name": "vers:cisco/3.11.9e",
"product_id": "CSAFPID-2715536"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.12.4s",
"product": {
"name": "vers:cisco/3.12.4s",
"product_id": "CSAFPID-2714784"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.13.9s",
"product": {
"name": "vers:cisco/3.13.9s",
"product_id": "CSAFPID-2715032"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.14.4s",
"product": {
"name": "vers:cisco/3.14.4s",
"product_id": "CSAFPID-2714746"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.15.4s",
"product": {
"name": "vers:cisco/3.15.4s",
"product_id": "CSAFPID-2714941"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.2as",
"product": {
"name": "vers:cisco/3.16.2as",
"product_id": "CSAFPID-2714791"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.2bs",
"product": {
"name": "vers:cisco/3.16.2bs",
"product_id": "CSAFPID-2714942"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.2s",
"product": {
"name": "vers:cisco/3.16.2s",
"product_id": "CSAFPID-2714788"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.3as",
"product": {
"name": "vers:cisco/3.16.3as",
"product_id": "CSAFPID-2714943"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.3s",
"product": {
"name": "vers:cisco/3.16.3s",
"product_id": "CSAFPID-2714798"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.4s",
"product": {
"name": "vers:cisco/3.16.4s",
"product_id": "CSAFPID-2714944"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.4gs",
"product": {
"name": "vers:cisco/3.16.4gs",
"product_id": "CSAFPID-2714974"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.4es",
"product": {
"name": "vers:cisco/3.16.4es",
"product_id": "CSAFPID-2714985"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.4ds",
"product": {
"name": "vers:cisco/3.16.4ds",
"product_id": "CSAFPID-2714983"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.4cs",
"product": {
"name": "vers:cisco/3.16.4cs",
"product_id": "CSAFPID-2714978"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.4bs",
"product": {
"name": "vers:cisco/3.16.4bs",
"product_id": "CSAFPID-2714971"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.4as",
"product": {
"name": "vers:cisco/3.16.4as",
"product_id": "CSAFPID-2714967"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.5as",
"product": {
"name": "vers:cisco/3.16.5as",
"product_id": "CSAFPID-2714992"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.5bs",
"product": {
"name": "vers:cisco/3.16.5bs",
"product_id": "CSAFPID-2714996"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.5s",
"product": {
"name": "vers:cisco/3.16.5s",
"product_id": "CSAFPID-2714975"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.6bs",
"product": {
"name": "vers:cisco/3.16.6bs",
"product_id": "CSAFPID-2715025"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.6s",
"product": {
"name": "vers:cisco/3.16.6s",
"product_id": "CSAFPID-2714987"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.7as",
"product": {
"name": "vers:cisco/3.16.7as",
"product_id": "CSAFPID-2715168"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.8s",
"product": {
"name": "vers:cisco/3.16.8s",
"product_id": "CSAFPID-2715178"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.1as",
"product": {
"name": "vers:cisco/3.16.1as",
"product_id": "CSAFPID-2714787"
}
},
{
"category": "product_version_range",
"name": "vers:cisco/3.16.1s",
"product": {
"name": "vers:cisco/3.16.1s",
"product_id": "CSAFPID-2714773"
}
}
],
"category": "product_name",
"name": "Cisco IOS XE Software"
}
],
"category": "vendor",
"name": "Cisco"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-20137",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "other",
"text": "Improper Access Control",
"title": "CWE-284"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20137",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20137.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20137"
},
{
"cve": "CVE-2025-20140",
"cwe": {
"id": "CWE-789",
"name": "Memory Allocation with Excessive Size Value"
},
"notes": [
{
"category": "other",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20140",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20140.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20140"
},
{
"cve": "CVE-2025-20154",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20154",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20154.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20154"
},
{
"cve": "CVE-2025-20162",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20162",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20162.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20162"
},
{
"cve": "CVE-2025-20181",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"notes": [
{
"category": "other",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20181",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20181.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20181"
},
{
"cve": "CVE-2025-20182",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20182",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20182.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20182"
},
{
"cve": "CVE-2025-20186",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20186",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20186.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20186"
},
{
"cve": "CVE-2025-20188",
"cwe": {
"id": "CWE-798",
"name": "Use of Hard-coded Credentials"
},
"notes": [
{
"category": "other",
"text": "Use of Hard-coded Credentials",
"title": "CWE-798"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20188",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20188.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20188"
},
{
"cve": "CVE-2025-20189",
"cwe": {
"id": "CWE-762",
"name": "Mismatched Memory Management Routines"
},
"notes": [
{
"category": "other",
"text": "Mismatched Memory Management Routines",
"title": "CWE-762"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20189",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20189.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20189"
},
{
"cve": "CVE-2025-20190",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "other",
"text": "Improper Access Control",
"title": "CWE-284"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20190",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20190.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20190"
},
{
"cve": "CVE-2025-20192",
"cwe": {
"id": "CWE-232",
"name": "Improper Handling of Undefined Values"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Undefined Values",
"title": "CWE-232"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20192",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20192.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20192"
},
{
"cve": "CVE-2025-20194",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "other",
"text": "Cross-Site Request Forgery (CSRF)",
"title": "CWE-352"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20194",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20194.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20194"
},
{
"cve": "CVE-2025-20202",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"notes": [
{
"category": "other",
"text": "Buffer Access with Incorrect Length Value",
"title": "CWE-805"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20202",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-20202.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2714930",
"CSAFPID-2715313",
"CSAFPID-2715043",
"CSAFPID-2715520",
"CSAFPID-2715459",
"CSAFPID-2715039",
"CSAFPID-2714932",
"CSAFPID-2715445",
"CSAFPID-2715031",
"CSAFPID-2715164",
"CSAFPID-2715478",
"CSAFPID-2715170",
"CSAFPID-2715017",
"CSAFPID-2714865",
"CSAFPID-2714842",
"CSAFPID-2714989",
"CSAFPID-2715536",
"CSAFPID-2714784",
"CSAFPID-2715032",
"CSAFPID-2714746",
"CSAFPID-2714941",
"CSAFPID-2714791",
"CSAFPID-2714942",
"CSAFPID-2714788",
"CSAFPID-2714943",
"CSAFPID-2714798",
"CSAFPID-2714944",
"CSAFPID-2714974",
"CSAFPID-2714985",
"CSAFPID-2714983",
"CSAFPID-2714978",
"CSAFPID-2714971",
"CSAFPID-2714967",
"CSAFPID-2714992",
"CSAFPID-2714996",
"CSAFPID-2714975",
"CSAFPID-2715025",
"CSAFPID-2714987",
"CSAFPID-2715168",
"CSAFPID-2715178",
"CSAFPID-2714787",
"CSAFPID-2714773"
]
}
],
"title": "CVE-2025-20202"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.